CVE-2025-58365: XWiki Blog Application Remote Code Execution Vulnerability
Summary
CVE-2025-58365: XWiki Blog Application: Privilege Escalation (PR) from account through blog content. Affects org.xwiki.contrib.blog:application-blog-ui versions < 9.14. Fixed in 9.14. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The XWiki Blog Application is a component of the XWiki platform that allows users to create and manage blog posts. It provides functionalities such as editing, commenting, and categorizing blog entries. The application is designed for logged-in users who have the ability to edit their own profiles and create blog content. However, a critical vulnerability has been identified that allows unauthorized remote code execution due to improper handling of user input in blog posts.
Vulnerability Detail
The vulnerability arises from the ability of any user with edit rights on any page to execute arbitrary code. This is achieved by adding an object of type 'Blog.BlogPostClass' to any page and inserting a script macro containing malicious code into the 'Content' field of that object. The implications of this vulnerability are severe, as it allows attackers to execute code with the privileges of the user who authored the blog post, potentially leading to full system compromise.
How To Fix
Minimum fixed version
9.14
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no known workarounds for this vulnerability. The best course of action is to apply the patch by updating to the latest version of the application.
Conclusion
The XWiki Blog Application has a critical vulnerability (CVE-2025-58365) that allows remote code execution for users with edit rights. It is essential to update to version 9.14 or later to mitigate this risk. Regular monitoring and prompt updates are crucial for maintaining security.
See every vulnerability recorded for org.xwiki.contrib.blog:application-blog-ui →
FAQ
CVE-2025-58365 is a vulnerability in the XWiki Blog Application that allows remote code execution for users with edit rights on any page.
Any user with edit rights on pages within the XWiki Blog Application is potentially affected by this vulnerability.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring any signup.
If you cannot update immediately, ensure that users with edit rights are trusted and monitor for any suspicious activity until you can apply the patch.
Exploitation of this vulnerability could lead to unauthorized access and control over the server, allowing attackers to execute arbitrary code and compromise the system.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.xwiki.contrib.blog:application-blog-ui.
