GHSA-9875-cw22-f7cx

Source

https://github.com/advisories/GHSA-9875-cw22-f7cx

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/06/GHSA-9875-cw22-f7cx/GHSA-9875-cw22-f7cx.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-9875-cw22-f7cx

Aliases

CVE-2025-49581

Published

2025-06-13T20:40:19Z

Modified

2026-04-01T17:34:16Z

Severity

8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

XWiki allows remote code execution through default value of wiki macro wiki-type parameters

Details

Impact

Any user with edit right on a page (could be the user's profile) can execute code (Groovy, Python, Velocity) with programming right by defining a wiki macro. This allows full access to the whole XWiki installation and thus impacts its confidentiality, integrity and availability. The main problem is that if a wiki macro parameter allows wiki syntax, its default value is executed with the rights of the author of the document where it is used. This can be exploited by overriding a macro like the children macro that is used in a page that has programming right like the page XWiki.ChildrenMacro and thus allows arbitrary script macros. The full reproduction steps can be found in the original issue.

Patches

This vulnerability has been patched in XWiki 16.4.7, 16.10.3 and 17.0.0 by executing wiki parameters with the rights of the wiki macro's author when the parameter's value is the default value.

Workarounds

We're not aware of any workarounds except for upgrading.

Database specific

{
    "cwe_ids": [
        "CWE-94"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-06-13T20:40:19Z",
    "nvd_published_at": "2025-06-13T16:15:27Z",
    "severity": "HIGH"
}

References

Affected packages

Maven

org.xwiki.platform:xwiki-platform-rendering-wikimacro-store

Package

Name: org.xwiki.platform:xwiki-platform-rendering-wikimacro-store; View open source insights on deps.dev
Purl: pkg:maven/org.xwiki.platform/xwiki-platform-rendering-wikimacro-store

Affected ranges

Type: ECOSYSTEM
Events: Introduced

11.10.11

Database specific

last_known_affected_version_range

"< 12.0"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/06/GHSA-9875-cw22-f7cx/GHSA-9875-cw22-f7cx.json"

org.xwiki.platform:xwiki-platform-rendering-wikimacro-store

Package

Name: org.xwiki.platform:xwiki-platform-rendering-wikimacro-store; View open source insights on deps.dev
Purl: pkg:maven/org.xwiki.platform/xwiki-platform-rendering-wikimacro-store

Affected ranges

Type: ECOSYSTEM
Events: Introduced

12.6.3

Database specific

last_known_affected_version_range

"< 12.7"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/06/GHSA-9875-cw22-f7cx/GHSA-9875-cw22-f7cx.json"

org.xwiki.platform:xwiki-platform-rendering-wikimacro-store

Package

Name: org.xwiki.platform:xwiki-platform-rendering-wikimacro-store; View open source insights on deps.dev
Purl: pkg:maven/org.xwiki.platform/xwiki-platform-rendering-wikimacro-store

Affected ranges

Type: ECOSYSTEM
Events: Introduced

12.8-rc-1

Fixed

16.4.7

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/06/GHSA-9875-cw22-f7cx/GHSA-9875-cw22-f7cx.json"

org.xwiki.platform:xwiki-platform-rendering-wikimacro-store

Package

Name: org.xwiki.platform:xwiki-platform-rendering-wikimacro-store; View open source insights on deps.dev
Purl: pkg:maven/org.xwiki.platform/xwiki-platform-rendering-wikimacro-store

Affected ranges

Type: ECOSYSTEM
Events: Introduced

16.5.0-rc-1

Fixed

16.10.3

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/06/GHSA-9875-cw22-f7cx/GHSA-9875-cw22-f7cx.json"

org.xwiki.platform:xwiki-platform-rendering-wikimacro-store

Package

Name: org.xwiki.platform:xwiki-platform-rendering-wikimacro-store; View open source insights on deps.dev
Purl: pkg:maven/org.xwiki.platform/xwiki-platform-rendering-wikimacro-store

Affected ranges

Type: ECOSYSTEM
Events: Introduced

17.0.0-rc-1

Fixed

17.0.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/06/GHSA-9875-cw22-f7cx/GHSA-9875-cw22-f7cx.json"