CVE-2025-49586
- Source
- https://cve.org/CVERecord?id=CVE-2025-49586
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-49586.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2025-49586
- Aliases
- Published
- 2025-06-13T17:47:07.105Z
- Modified
- 2026-08-12T15:13:55.679610Z
- Severity
-
- 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- XWiki allows remote code execution through preview of XClass changes in AWM editor
- Details
-
XWiki is an open-source wiki software platform. Any XWiki user with edit right on at least one App Within Minutes application (the default for all users XWiki) can obtain programming right/perform remote code execution by editing the application. This vulnerability has been fixed in XWiki 17.0.0, 16.4.7, and 16.10.3.
- Database specific
{ "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/49xxx/CVE-2025-49586.json", "cna_assigner": "GitHub_M", "cwe_ids": [ "CWE-863" ] }- References
-
- https://jira.xwiki.org/browse/XWIKI-22719
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/49xxx/CVE-2025-49586.json
- https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-jp4x-w9cj-97q7
- https://nvd.nist.gov/vuln/detail/CVE-2025-49586
- https://github.com/xwiki/xwiki-platform/commit/ef978315649cf83eae396021bb33603a1a5f7e42
Affected packages
Git / github.com/xwiki/xwiki-commons
Affected ranges
- Type
- GIT
- Repo
- https://github.com/xwiki/xwiki-commons
- Events
-
IntroducedFixedIntroducedFixedIntroducedLast affected
- Database specific
-
Show details
{ "source": [ "CPE_RANGE", "CPE_STRING" ], "cpe": [ "cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*", "cpe:2.3:a:xwiki:xwiki:7.2:milestone2:*:*:*:*:*:*", "cpe:2.3:a:xwiki:xwiki:7.2:milestone3:*:*:*:*:*:*" ], "extracted_events": [ { "introduced": "7.3" }, { "fixed": "16.4.7" }, { "introduced": "16.5.0" }, { "fixed": "16.10.3" }, { "introduced": "7.2-milestone2" }, { "last_affected": "7.2-milestone2" }, { "introduced": "7.2-milestone3" }, { "last_affected": "7.2-milestone3" } ] }
- Type
- GIT
- Repo
- https://github.com/xwiki/xwiki-platform
- Events
- Database specific
-
Show details
{ "source": [ "CPE_RANGE", "CPE_STRING", "REFERENCES" ], "cpe": [ "cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*", "cpe:2.3:a:xwiki:xwiki:7.2:milestone2:*:*:*:*:*:*", "cpe:2.3:a:xwiki:xwiki:7.2:milestone3:*:*:*:*:*:*" ], "extracted_events": [ { "introduced": "7.3" }, { "fixed": "16.4.7" }, { "introduced": "16.5.0" }, { "fixed": "16.10.3" }, { "introduced": "7.2-milestone2" }, { "last_affected": "7.2-milestone2" }, { "introduced": "7.2-milestone3" }, { "last_affected": "7.2-milestone3" } ] }
Database specific
vanir_signatures
[
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"line_hashes": [
"88056371801129439393603216964005880960",
"243874483758298929353018740184486391721",
"157154770268637902133741951968906361400",
"222230847715378379706470041518623815940",
"257987567835481188112663690216475254695",
"14178863615932029679974832388040924610",
"159375539112173457013987556070739220251",
"169630682598187821745413707582583576333",
"53865781580485702225522380105047968218",
"152761112594932920870077440317867397416",
"101774292180674610088893663042953797200",
"324187643284816238668183484813826028693",
"114065041320961532354224894364447811351",
"4385708028378267392098971724499126632",
"181208447682209001316245315671685470233",
"295407642657319325283065223690371837990",
"1334653094449167452274428159926731720",
"204419657364758336765445464259318755118",
"134156539473107085282535521100768221026",
"99972270439302202698232084448185645955",
"26650894625846250765989164977446986539",
"227741972265079575059542753098839707357",
"92474453688505862599522123567797750238",
"334305464701464106636828679690766468273",
"127020532283632265904975322883311643544",
"131234046097332997579785053609329483392",
"259468903975290189077467597873908161025",
"62488527098462729328611099232829122854",
"138657341072624268514707363512864321771",
"214972680125672562606570230356861888948",
"180563482172875573204987040367149155908",
"245430175325478782582825497781938335876",
"329811685623014983799127915380322501817",
"191691866896582082463447956084377266243",
"62652287021849066565384271522563502059",
"327131720233497180801278307421451701604",
"168218157939892447303071095930853194344",
"208326756325612507473000390708659468750",
"41879863245529428531972832792832487149",
"123183397650040630516201246693274934555",
"80098788164363811684597407826397290230",
"251311883521115400868068540550857238808",
"169892318178119867396634793531462932741",
"26575517123589722828344753722464222444",
"55298824493271449317421094744909481270",
"184888802040989885714038509878693235968",
"326765963262692642006399677692880333752",
"152509382163989857048201475788331401040",
"245100065397562093816285128127125755268"
],
"threshold": 0.9
},
"id": "CVE-2025-49586-15abc932",
"target": {
"file": "xwiki-platform-core/xwiki-platform-oldcore/src/test/java/com/xpn/xwiki/objects/classes/PropertyClassTest.java"
},
"source": "https://github.com/xwiki/xwiki-platform/commit/ef978315649cf83eae396021bb33603a1a5f7e42",
"signature_version": "v1"
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"line_hashes": [
"172166885950853625472209083528346364527",
"310123872512017473080959231745089015074",
"120602934919254131372164579458433181029",
"70408719690255586196329936435701511804",
"274033723923858593887719092643275116194",
"290103087779532091558248290856589718973",
"252541003888067422865556826778316380519",
"265383410478499025052396815364601622216",
"13374543538955399779528030046225904463",
"133647884505012148475758144537782325970",
"143991354290431808471122957055852694493",
"48295507816989569593585476258884554389",
"166302137040816925980360925645938028941",
"273701896656080210334384332078304728446",
"250171595542248573240968275964039381792",
"297907069727834891065984497309467277730"
],
"threshold": 0.9
},
"id": "CVE-2025-49586-5cda7ff1",
"target": {
"file": "xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/objects/classes/PropertyClass.java"
},
"source": "https://github.com/xwiki/xwiki-platform/commit/ef978315649cf83eae396021bb33603a1a5f7e42",
"signature_version": "v1"
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 489.0,
"function_hash": "88502491533919853640029979014038684774"
},
"id": "CVE-2025-49586-68799c33",
"target": {
"function": "displayCustomWithAuthor",
"file": "xwiki-platform-core/xwiki-platform-oldcore/src/test/java/com/xpn/xwiki/objects/classes/PropertyClassTest.java"
},
"source": "https://github.com/xwiki/xwiki-platform/commit/ef978315649cf83eae396021bb33603a1a5f7e42",
"signature_version": "v1"
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 648.0,
"function_hash": "320062232082025276346068413185055705671"
},
"id": "CVE-2025-49586-76cd3fe9",
"target": {
"function": "before",
"file": "xwiki-platform-core/xwiki-platform-oldcore/src/test/java/com/xpn/xwiki/objects/classes/PropertyClassTest.java"
},
"source": "https://github.com/xwiki/xwiki-platform/commit/ef978315649cf83eae396021bb33603a1a5f7e42",
"signature_version": "v1"
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 2143.0,
"function_hash": "37697156820792496635098212090889430059"
},
"id": "CVE-2025-49586-f28beb34",
"target": {
"function": "displayCustom",
"file": "xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/objects/classes/PropertyClass.java"
},
"source": "https://github.com/xwiki/xwiki-platform/commit/ef978315649cf83eae396021bb33603a1a5f7e42",
"signature_version": "v1"
}
]
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-49586.json"
vanir_signatures_modified
"2026-08-12T15:13:55Z"