CVE-2025-66472: Reflected XSS Vulnerability in XWiki's Flamingo Skin Resources and Web Templates
Summary
CVE-2025-66472: XWiki vulnerable to a reflected XSS via xredirect parameter in DeleteApplication. Affects org.xwiki.platform:xwiki-platform-flamingo-skin-resources across 2 version ranges.
>= 6.2-milestone-1, < 16.10.10
>= 17.0.0-rc-1, < 17.4.2
Fixed in 16.10.10 or 17.4.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
XWiki is a powerful open-source platform designed for collaborative content creation and management. It allows users to create, edit, and organize content in a wiki format. The platform is extensible and supports various applications, making it popular among developers and organizations. However, it has been found to be vulnerable to a reflected cross-site scripting (XSS) attack, specifically through the 'xredirect' parameter in the DeleteApplication feature, which can lead to severe security risks.
Vulnerability Detail
The reflected XSS vulnerability in XWiki allows an attacker to craft a malicious URL that, when accessed by a victim, executes an attacker-supplied script upon clicking the 'No' button on a deletion confirmation message. This vulnerability primarily affects users with admin or programming rights, enabling attackers to perform arbitrary actions on the XWiki installation, including potential remote code execution. The issue arises from improper handling of user input in the affected URL parameter.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 6.2-milestone-1, < 16.10.1016.10.10 -
>= 17.0.0-rc-1, < 17.4.217.4.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, you can manually apply the patch to the templates present in the WAR file. This involves modifying the relevant code to ensure that the affected URL parameter is used only in the intended context. After applying the changes, a restart of XWiki is required for the updates to take effect.
Conclusion
The CVE-2025-66472 vulnerability in XWiki poses significant security risks due to its potential for reflected XSS attacks. It is crucial for users to update their installations to the patched versions or apply the recommended workarounds to mitigate these risks effectively.
See every vulnerability recorded for org.xwiki.platform:xwiki-platform-flamingo-skin-resources →
FAQ
A reflected XSS vulnerability allows an attacker to inject malicious scripts into web pages that are then executed in the context of a user's browser, potentially compromising user data and session integrity.
You can check if your application is affected by using Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can access the Vulert playground without signup to test your application.
If exploited, this vulnerability can allow attackers to execute arbitrary actions on the XWiki installation, including remote code execution, which can lead to data breaches and system compromise.
To apply the patch, update the relevant packages in your Maven project to the specified patched versions in the 'pom.xml' file and run the update commands.
Yes, you can apply a manual patch to the templates in the WAR file as a temporary workaround until you can update to the patched versions.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.xwiki.platform:xwiki-platform-flamingo-skin-resources.
