CVE-2025-49581: Remote Code Execution Vulnerability in XWiki Macro Parameters
Summary
CVE-2025-49581: XWiki allows remote code execution through default value of wiki macro wiki-type parameters. Affects org.xwiki.platform:xwiki-platform-rendering-wikimacro-store across 5 version ranges.
>= 11.10.11
>= 12.6.3
>= 12.8-rc-1, < 16.4.7
>= 16.5.0-rc-1, < 16.10.3
>= 17.0.0-rc-1, < 17.0.0
Fixed in 16.4.7, 16.10.3 or 17.0.0, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
XWiki is a powerful open-source platform designed for collaborative documentation and knowledge management. It allows users to create, edit, and manage content in a wiki-style format. The platform supports various programming languages and provides a rich set of features, including macros that enhance the functionality of wiki pages. However, a critical vulnerability has been identified in the handling of default values for wiki macro parameters, which can lead to severe security risks.
Vulnerability Detail
The vulnerability arises from the way XWiki processes default values for wiki macro parameters. Any user with edit rights on a page can exploit this flaw by defining a wiki macro that executes code (Groovy, Python, Velocity) with the permissions of the document's author. This can lead to unauthorized access and manipulation of the entire XWiki installation, compromising its confidentiality, integrity, and availability. The issue is particularly concerning when a macro parameter allows wiki syntax, as the default value is executed without proper restrictions.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 12.8-rc-1, < 16.4.716.4.7 -
>= 16.5.0-rc-1, < 16.10.316.10.3 -
>= 17.0.0-rc-1, < 17.0.017.0.0
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
Currently, there are no known workarounds for this vulnerability other than upgrading to the patched versions mentioned above.
Conclusion
The CVE-2025-49581 vulnerability in XWiki poses a significant risk due to its potential for remote code execution. Users are strongly advised to upgrade to the patched versions to mitigate this threat. Regular monitoring and updates are essential to maintain the security of the XWiki platform.
See every vulnerability recorded for org.xwiki.platform:xwiki-platform-rendering-wikimacro-store →
FAQ
CVE-2025-49581 is a vulnerability in XWiki that allows remote code execution through improperly handled default values of wiki macro parameters.
Any user with edit rights on a page in XWiki can potentially exploit this vulnerability, affecting the entire XWiki installation.
Exploitation of this vulnerability can lead to unauthorized access, data manipulation, and complete compromise of the XWiki system.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without needing to sign up.
The CVSS score of this vulnerability is 8.7, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.xwiki.platform:xwiki-platform-rendering-wikimacro-store.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
