CVE-2025-49582
- Source
- https://cve.org/CVERecord?id=CVE-2025-49582
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-49582.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2025-49582
- Aliases
- Published
- 2025-06-13T16:41:45.131Z
- Modified
- 2026-07-10T20:51:31.014796Z
- Severity
-
- 8.6 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- XWiki's required right warnings for macros are incomplete
- Details
-
XWiki is a generic wiki platform. When editing content that contains "dangerous" macros like malicious script macros that were authored by a user with fewer rights, XWiki warns about the execution of these macros since XWiki 15.9RC1. These required rights analyzers that trigger these warnings are incomplete, allowing an attacker to hide malicious content. For most macros, the existing analyzers don't consider non-lowercase parameters. Further, most macro parameters that can contain XWiki syntax like titles of information boxes weren't analyzed at all. Similarly, the "source" parameters of the content and context macro weren't anylzed even though they could contain arbitrary XWiki syntax. In the worst case, this could allow a malicious to add malicious script macros including Groovy or Python macros to a page that are then executed after another user with programming righs edits the page, thus allowing remote code execution. The required rights analyzers have been made more robust and extended to cover those cases in XWiki 16.4.7, 16.10.3 and 17.0.0.
- Database specific
{ "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/49xxx/CVE-2025-49582.json", "cna_assigner": "GitHub_M", "cwe_ids": [ "CWE-357" ] }- References
-
- https://jira.xwiki.org/browse/XWIKI-22758
- https://jira.xwiki.org/browse/XWIKI-22759
- https://jira.xwiki.org/browse/XWIKI-22763
- https://jira.xwiki.org/browse/XWIKI-22799
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/49xxx/CVE-2025-49582.json
- https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-c32m-27pj-4xcj
- https://nvd.nist.gov/vuln/detail/CVE-2025-49582
- https://github.com/xwiki/xwiki-platform/commit/0a705e8e253cb871b804e25c53b2bde879c886bd
- https://github.com/xwiki/xwiki-platform/commit/3d451e957fe2b14459e9ac64172b4a0e4c46971c
- https://github.com/xwiki/xwiki-platform/commit/abdcefc0db27035b67329add836fd683e0cf92b8
- https://github.com/xwiki/xwiki-platform/commit/cc74dc802efe0e2d3fa2ba3355dbadc51c5fd8c7
Affected packages
Git / github.com/xwiki/xwiki-commons
Affected ranges
- Type
- GIT
- Repo
- https://github.com/xwiki/xwiki-commons
- Events
- Database specific
{ "source": "CPE_RANGE", "cpe": "cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*", "extracted_events": [ { "introduced": "15.9" }, { "fixed": "16.4.7" }, { "introduced": "16.5.0" }, { "fixed": "16.10.3" } ] }
- Type
- GIT
- Repo
- https://github.com/xwiki/xwiki-platform
- Events
-
IntroducedFixedIntroducedFixedFixedFixedFixedFixed
- Database specific
{ "source": [ "CPE_RANGE", "REFERENCES" ], "cpe": "cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*", "extracted_events": [ { "introduced": "15.9" }, { "fixed": "16.4.7" }, { "introduced": "16.5.0" }, { "fixed": "16.10.3" } ] }
Database specific
vanir_signatures_modified
"2026-07-10T20:51:31Z"
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-49582.json"
vanir_signatures
[
{
"id": "CVE-2025-49582-003172ca",
"digest": {
"function_hash": "235305143574982914062327195251672197676",
"length": 371.0
},
"signature_version": "v1",
"signature_type": "Function",
"source": "https://github.com/xwiki/xwiki-platform/commit/3d451e957fe2b14459e9ac64172b4a0e4c46971c",
"deprecated": false,
"target": {
"function": "analyze",
"file": "xwiki-platform-core/xwiki-platform-rendering/xwiki-platform-rendering-macros/xwiki-platform-rendering-macro-cache/src/test/java/org/xwiki/rendering/internal/macro/cache/CacheMacroRequiredRightsAnalyzerTest.java"
}
},
{
"id": "CVE-2025-49582-024ecbb2",
"digest": {
"line_hashes": [
"314155969856412885120243083993630248651",
"311809464120539603119028463634319108810",
"249354558512541941452984106101750456969",
"27798607160872807789407277015796445301",
"309512082645042633066049800122327940055",
"264693861861356165565835185706383251252",
"113428933441516372774335185205627932333",
"73050983018509363775963728053963682114"
],
"threshold": 0.9
},
"signature_version": "v1",
"signature_type": "Line",
"source": "https://github.com/xwiki/xwiki-platform/commit/3d451e957fe2b14459e9ac64172b4a0e4c46971c",
"deprecated": false,
"target": {
"file": "xwiki-platform-core/xwiki-platform-rendering/xwiki-platform-rendering-xwiki/src/test/java/org/xwiki/rendering/internal/macro/HTMLMacroRequiredRightsAnalyzerTest.java"
}
},
{
"id": "CVE-2025-49582-093714cf",
"digest": {
"function_hash": "228683720350286898463453930926807511364",
"length": 1306.0
},
"signature_version": "v1",
"signature_type": "Function",
"source": "https://github.com/xwiki/xwiki-platform/commit/3d451e957fe2b14459e9ac64172b4a0e4c46971c",
"deprecated": false,
"target": {
"function": "analyze",
"file": "xwiki-platform-core/xwiki-platform-rendering/xwiki-platform-rendering-xwiki/src/main/java/org/xwiki/rendering/internal/macro/HTMLMacroRequiredRightsAnalyzer.java"
}
},
{
"id": "CVE-2025-49582-578ad0eb",
"digest": {
"function_hash": "89628001991822442222256481846658510221",
"length": 706.0
},
"signature_version": "v1",
"signature_type": "Function",
"source": "https://github.com/xwiki/xwiki-platform/commit/abdcefc0db27035b67329add836fd683e0cf92b8",
"deprecated": false,
"target": {
"function": "analyzeWithExceptions",
"file": "xwiki-platform-core/xwiki-platform-security/xwiki-platform-security-requiredrights/xwiki-platform-security-requiredrights-default/src/main/java/org/xwiki/platform/security/requiredrights/internal/analyzer/DefaultMacroBlockRequiredRightAnalyzer.java"
}
},
{
"id": "CVE-2025-49582-61774128",
"digest": {
"line_hashes": [
"248683916824713251808258694165541806912",
"44056805028594856899957420174019387392",
"40834180126295611909679447539783006959",
"66601881815802445662856493232493337746",
"223432701982936772179894690131154626658",
"46881405650900160231566747181075824113",
"219109683626831899273207836399267546246",
"153958849507251931285251424360316496933",
"214899489810292364316170152957512836842",
"5252715175168381181687828680346999974",
"187340939015039383969877410124590671490",
"97185617565108243134189535769745616331",
"167548448445891519813624401546977680423",
"127520936244115035180320097047985844375",
"138013534232827430511207819947601911051",
"124127917164446895312977870383198860260",
"86273418629889509353551665240572117710",
"235501258910360480652644565262040233010"
],
"threshold": 0.9
},
"signature_version": "v1",
"signature_type": "Line",
"source": "https://github.com/xwiki/xwiki-platform/commit/abdcefc0db27035b67329add836fd683e0cf92b8",
"deprecated": false,
"target": {
"file": "xwiki-platform-core/xwiki-platform-security/xwiki-platform-security-requiredrights/xwiki-platform-security-requiredrights-default/src/test/java/org/xwiki/platform/security/requiredrights/internal/analyzer/DefaultMacroBlockRequiredRightAnalyzerTest.java"
}
},
{
"id": "CVE-2025-49582-86b34ae5",
"digest": {
"function_hash": "288661234016873151807248274033087166674",
"length": 265.0
},
"signature_version": "v1",
"signature_type": "Function",
"source": "https://github.com/xwiki/xwiki-platform/commit/cc74dc802efe0e2d3fa2ba3355dbadc51c5fd8c7",
"deprecated": false,
"target": {
"function": "analyze",
"file": "xwiki-platform-core/xwiki-platform-rendering/xwiki-platform-rendering-macros/xwiki-platform-rendering-macro-context/src/main/java/org/xwiki/rendering/internal/macro/context/ContextMacroRequiredRightsAnalyzer.java"
}
},
{
"id": "CVE-2025-49582-9e86108d",
"digest": {
"function_hash": "114822234755268740887288591097314038612",
"length": 552.0
},
"signature_version": "v1",
"signature_type": "Function",
"source": "https://github.com/xwiki/xwiki-platform/commit/3d451e957fe2b14459e9ac64172b4a0e4c46971c",
"deprecated": false,
"target": {
"function": "analyze",
"file": "xwiki-platform-core/xwiki-platform-rendering/xwiki-platform-rendering-xwiki/src/test/java/org/xwiki/rendering/internal/macro/RawMacroRequiredRightsAnalyzerTest.java"
}
},
{
"id": "CVE-2025-49582-a691d067",
"digest": {
"line_hashes": [
"25305908426353763878398429194390914125",
"332865150289053461404684676758632903552",
"265850024812684181549162460519693335199",
"189392902779550771582162657587168978277",
"229510170235464515500588684549941333616",
"128047361485415510549636775704409311679",
"5226644185592764588571845684183702068",
"54177982657052548832675509133273229775",
"218673080937962336695974848015384802019",
"229857287877006771662869513075531530850",
"216020705131424389594492525578040184075",
"316130433178470820486338030707106604477",
"191211726210571023296339153076834185279",
"242418116089109129569288603725561482975",
"138008720758359461582554767204055412351",
"273200265235926291916842403794871440810",
"139883319948585012142760132510065562303",
"287853316119256110116906273586994501487",
"35591650455752599684007489968975589793",
"307079214305419346160946605468682196431",
"172728748806944302346583027804269368644",
"270509232453034733434852948071161111178",
"11364220766012634427410200514280013241",
"108095321373035739274672440556915021483",
"22905499286180078136539466079734569314",
"200109387836001105431565037607037399641",
"16070493550151522611214027410020040194",
"78770856094349735470040919665684681067",
"86890163251335330102206708858947818164",
"203155413508646107739008151164809121404"
],
"threshold": 0.9
},
"signature_version": "v1",
"signature_type": "Line",
"source": "https://github.com/xwiki/xwiki-platform/commit/3d451e957fe2b14459e9ac64172b4a0e4c46971c",
"deprecated": false,
"target": {
"file": "xwiki-platform-core/xwiki-platform-rendering/xwiki-platform-rendering-xwiki/src/test/java/org/xwiki/rendering/internal/macro/RawMacroRequiredRightsAnalyzerTest.java"
}
},
{
"id": "CVE-2025-49582-b00baf8e",
"digest": {
"line_hashes": [
"42412005904802213185269323312139730164",
"76412558358167331784914680326039449630",
"230858229873406835534393344686209283206",
"57608221344348083845724934030115009349",
"90293501061974149424114955957515306079",
"194437765982722373176698360048926168386",
"258414668843908514640089326699810273061",
"292548552224725043584290325481463506209",
"89117810523169701177877662900965092225",
"305030817161272820784748529389283509011",
"338544266124092163433086475657979482853",
"232624841672077921831763856816027013717",
"108587633537507210242609878158511307392"
],
"threshold": 0.9
},
"signature_version": "v1",
"signature_type": "Line",
"source": "https://github.com/xwiki/xwiki-platform/commit/3d451e957fe2b14459e9ac64172b4a0e4c46971c",
"deprecated": false,
"target": {
"file": "xwiki-platform-core/xwiki-platform-rendering/xwiki-platform-rendering-xwiki/src/main/java/org/xwiki/rendering/internal/macro/HTMLMacroRequiredRightsAnalyzer.java"
}
},
{
"id": "CVE-2025-49582-b462e403",
"digest": {
"line_hashes": [
"195383052062971528290258143037606006974",
"121147934862293644318223121108061030012",
"112965115559864019592300372200845883583",
"105787123406870835022384621319119564932",
"184475166291282548766627178404940778913",
"219559118566797664587926251416065009520",
"236901240113997621676600184576019669883",
"71304402365093247034470054750937210515",
"211866269934021298458109792386785474397",
"284985444740279798696736757844023505266",
"130031872075398440046210642627985692316",
"28778134755325173924931364149116929880",
"270271483860581133720673468683456709941",
"110991688298404359578470425142360187281",
"27838123633814278103295413661651828316",
"181645595592214986386015281388804481518",
"135066953218804412433623088276744665157",
"41056096597614283021352793895940833427",
"59714211986909969146966612398181660584"
],
"threshold": 0.9
},
"signature_version": "v1",
"signature_type": "Line",
"source": "https://github.com/xwiki/xwiki-platform/commit/3d451e957fe2b14459e9ac64172b4a0e4c46971c",
"deprecated": false,
"target": {
"file": "xwiki-platform-core/xwiki-platform-rendering/xwiki-platform-rendering-macros/xwiki-platform-rendering-macro-cache/src/test/java/org/xwiki/rendering/internal/macro/cache/CacheMacroRequiredRightsAnalyzerTest.java"
}
},
{
"id": "CVE-2025-49582-c71c63cd",
"digest": {
"line_hashes": [
"276738066488381805261157201680718865855",
"164370008595539341956014735024825611459",
"262616887426566308977370055165610489664",
"21318239742178238277394075233369128626",
"237254102987221103667523445719797555172",
"330058200322767557362957504587808430898",
"21627028852512648231067761854713848160",
"59141606338868174779473946636934870441",
"143884815482871194234129193299697741884",
"17155123061976021419691533723293937547",
"234629842799974531962243726968545354147",
"130961549466645131151649528901824833994"
],
"threshold": 0.9
},
"signature_version": "v1",
"signature_type": "Line",
"source": "https://github.com/xwiki/xwiki-platform/commit/3d451e957fe2b14459e9ac64172b4a0e4c46971c",
"deprecated": false,
"target": {
"file": "xwiki-platform-core/xwiki-platform-rendering/xwiki-platform-rendering-xwiki/src/main/java/org/xwiki/rendering/internal/macro/RawMacroRequiredRightsAnalyzer.java"
}
},
{
"id": "CVE-2025-49582-cdeb4fb3",
"digest": {
"line_hashes": [
"132600938530182733092681992755499536016",
"13153002476370662215552005562743474463",
"64736672451221512473442173226846036680",
"254495155204050035142757874586850118906",
"338337232763699491287541939066870002567",
"52557038266222158918529276551484030368",
"299163024094887182719628010908463316536",
"148607089551700924669911308494642303386",
"318854787040316110921491332558118939833",
"116118932386364336233676448413438587198",
"164522654837879300440964326983835409563",
"293505213220487371789295650217783594818",
"201937082094564569048922355336345256851",
"295534043666617394366613672871593258178",
"29012764898561677218470015461307788294"
],
"threshold": 0.9
},
"signature_version": "v1",
"signature_type": "Line",
"source": "https://github.com/xwiki/xwiki-platform/commit/cc74dc802efe0e2d3fa2ba3355dbadc51c5fd8c7",
"deprecated": false,
"target": {
"file": "xwiki-platform-core/xwiki-platform-rendering/xwiki-platform-rendering-macros/xwiki-platform-rendering-macro-context/src/main/java/org/xwiki/rendering/internal/macro/context/ContextMacroRequiredRightsAnalyzer.java"
}
},
{
"id": "CVE-2025-49582-d02b2198",
"digest": {
"line_hashes": [
"292782975728246476210679671676246248877",
"163438177047017849665783186282390724233",
"31176276206579177320143055695245481250",
"148607089551700924669911308494642303386",
"25495157289446027352244061604805230092",
"135672579099723442865921284003523498764",
"149059873497223998984428317533104989185",
"225402803628712228278794988486832995473",
"124127917164446895312977870383198860260",
"110682154092063538200128735432143215632",
"10649016507255300931040694348268046711",
"18068771482343736038027688917526224809",
"276905478166767274820951307698529626567"
],
"threshold": 0.9
},
"signature_version": "v1",
"signature_type": "Line",
"source": "https://github.com/xwiki/xwiki-platform/commit/cc74dc802efe0e2d3fa2ba3355dbadc51c5fd8c7",
"deprecated": false,
"target": {
"file": "xwiki-platform-core/xwiki-platform-rendering/xwiki-platform-rendering-macros/xwiki-platform-rendering-macro-context/src/test/java/org/xwiki/rendering/internal/macro/context/ContextMacroRequiredRightsAnalyzerTest.java"
}
},
{
"id": "CVE-2025-49582-d0a016d4",
"digest": {
"function_hash": "233829013755286698717352821860120313778",
"length": 198.0
},
"signature_version": "v1",
"signature_type": "Function",
"source": "https://github.com/xwiki/xwiki-platform/commit/3d451e957fe2b14459e9ac64172b4a0e4c46971c",
"deprecated": false,
"target": {
"function": "analyzeTestCases",
"file": "xwiki-platform-core/xwiki-platform-rendering/xwiki-platform-rendering-xwiki/src/test/java/org/xwiki/rendering/internal/macro/RawMacroRequiredRightsAnalyzerTest.java"
}
},
{
"id": "CVE-2025-49582-d4c61853",
"digest": {
"function_hash": "247804012178890485861947138874718954374",
"length": 166.0
},
"signature_version": "v1",
"signature_type": "Function",
"source": "https://github.com/xwiki/xwiki-platform/commit/abdcefc0db27035b67329add836fd683e0cf92b8",
"deprecated": false,
"target": {
"function": "shouldMacroContentBeParsed",
"file": "xwiki-platform-core/xwiki-platform-security/xwiki-platform-security-requiredrights/xwiki-platform-security-requiredrights-default/src/main/java/org/xwiki/platform/security/requiredrights/internal/analyzer/DefaultMacroBlockRequiredRightAnalyzer.java"
}
},
{
"id": "CVE-2025-49582-d93188cf",
"digest": {
"function_hash": "231430094203034280860472005261255493618",
"length": 157.0
},
"signature_version": "v1",
"signature_type": "Function",
"source": "https://github.com/xwiki/xwiki-platform/commit/3d451e957fe2b14459e9ac64172b4a0e4c46971c",
"deprecated": false,
"target": {
"function": "analyze",
"file": "xwiki-platform-core/xwiki-platform-rendering/xwiki-platform-rendering-macros/xwiki-platform-rendering-macro-cache/src/main/java/org/xwiki/rendering/internal/macro/cache/CacheMacroRequiredRightsAnalyzer.java"
}
},
{
"id": "CVE-2025-49582-de1febc8",
"digest": {
"line_hashes": [
"325579037316400982895932797709283550193",
"99255768894288069419015293147941888353",
"55225510275208746887944463077340963929",
"232398720244875866492509754897382133022",
"84533743630781334150135723516399306299",
"271602715679328318980623804797119120129",
"175090837600517967393692228771675653841",
"176977289759308312455472024779933004596",
"248614179716427064349976817298301635644"
],
"threshold": 0.9
},
"signature_version": "v1",
"signature_type": "Line",
"source": "https://github.com/xwiki/xwiki-platform/commit/3d451e957fe2b14459e9ac64172b4a0e4c46971c",
"deprecated": false,
"target": {
"file": "xwiki-platform-core/xwiki-platform-rendering/xwiki-platform-rendering-macros/xwiki-platform-rendering-macro-cache/src/main/java/org/xwiki/rendering/internal/macro/cache/CacheMacroRequiredRightsAnalyzer.java"
}
},
{
"id": "CVE-2025-49582-ec86bf04",
"digest": {
"line_hashes": [
"212640317525585014960428878892610971769",
"38007280274902160396293632803830071086",
"199223639543099459485657674444168982855",
"25421045979510272820368307634102495184",
"88398930931839429071252612344221609394",
"82672814738918513840072475030753854207",
"281075531710560581128058494792678662934",
"127942334371151126992624868745973015605",
"227779521104918090318804153521828306674",
"111632356791907740519827236041080326430",
"209977171899804269991537221911262469895",
"298839521383502405799805654875515750722",
"239053565274598709827648809835826991913",
"149319737397567330174205565386869137508",
"87770959869340425756158690769332165555",
"115544456197011985989332942471861295035",
"189534682226434435708798524168451961407",
"117864180704777753900281286835341206923",
"125234676716008208853124178379080400295",
"204904030863125808864821971606313421330"
],
"threshold": 0.9
},
"signature_version": "v1",
"signature_type": "Line",
"source": "https://github.com/xwiki/xwiki-platform/commit/abdcefc0db27035b67329add836fd683e0cf92b8",
"deprecated": false,
"target": {
"file": "xwiki-platform-core/xwiki-platform-security/xwiki-platform-security-requiredrights/xwiki-platform-security-requiredrights-default/src/main/java/org/xwiki/platform/security/requiredrights/internal/analyzer/DefaultMacroBlockRequiredRightAnalyzer.java"
}
},
{
"id": "CVE-2025-49582-ed5b0ee7",
"digest": {
"function_hash": "256488238885253515097908283424624933416",
"length": 361.0
},
"signature_version": "v1",
"signature_type": "Function",
"source": "https://github.com/xwiki/xwiki-platform/commit/3d451e957fe2b14459e9ac64172b4a0e4c46971c",
"deprecated": false,
"target": {
"function": "analyze",
"file": "xwiki-platform-core/xwiki-platform-rendering/xwiki-platform-rendering-xwiki/src/main/java/org/xwiki/rendering/internal/macro/RawMacroRequiredRightsAnalyzer.java"
}
}
]