CVE-2025-32430: Reflected XSS Vulnerability in org.xwiki.platform:xwiki-platform-web-templates
Summary
CVE-2025-32430: XWiki allows Reflected XSS in two templates. Affects org.xwiki.platform:xwiki-platform-web-templates across 3 version ranges.
>= 4.2-milestone-3, < 16.4.8
>= 16.5.0-rc-1, < 16.10.6
>= 17.0.0-rc-1, < 17.3.0-rc-1
Fixed in 16.4.8, 16.10.6 or 17.3.0-rc-1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The org.xwiki.platform:xwiki-platform-web-templates package is a component of the XWiki platform, which is an open-source wiki software that allows users to create, manage, and share content collaboratively. This package specifically handles web templates, enabling dynamic content rendering. However, it has been found to be vulnerable to reflected cross-site scripting (XSS), which can compromise user sessions and allow attackers to execute malicious scripts.
Vulnerability Detail
The vulnerability arises from reflected XSS in two specific templates within the xwiki-platform-web-templates package. Attackers can exploit this by crafting URLs that, when visited by victims, execute arbitrary JavaScript code in the context of the victim's session. This can lead to unauthorized actions being performed with the victim's permissions. The vulnerability is categorized under CWE-79, indicating improper neutralization of input during web page generation.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 4.2-milestone-3, < 16.4.816.4.8 -
>= 16.5.0-rc-1, < 16.10.616.10.6 -
>= 17.0.0-rc-1, < 17.3.0-rc-117.3.0-rc-1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, you can manually patch the affected templates in the WAR file by applying the changes outlined in the commit found here: https://github.com/xwiki/xwiki-platform/commit/e5926a938cbecc8b1eaa48053d8d370cff107cb0.
Conclusion
The org.xwiki.platform:xwiki-platform-web-templates package has a reflected XSS vulnerability that can be exploited by attackers to execute malicious scripts in user sessions. It is crucial to update to the patched versions to mitigate this risk. For immediate checks on vulnerability status, tools like Vulert can be utilized.
See every vulnerability recorded for org.xwiki.platform:xwiki-platform-web-templates →
FAQ
CVE-2025-32430 is a vulnerability identifier for a reflected XSS issue found in the org.xwiki.platform:xwiki-platform-web-templates package.
If exploited, this vulnerability can allow attackers to execute malicious scripts in the context of a user's session, potentially leading to unauthorized actions and data exposure.
The vulnerability affects versions introduced from 4.2-milestone-3 up to 17.0.0-rc-1, with specific fixed versions being 16.4.8, 16.10.6, and 17.3.0-rc-1.
You can check if your application is affected by using Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can access the Vulert playground at Vulert Scanner without needing to sign up.
If you cannot update the package immediately, consider applying the manual patch to the affected templates as a temporary measure until you can perform a full update.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.xwiki.platform:xwiki-platform-web-templates.
