{"id":"CVE-2025-49586","published":"2025-06-13T17:47:07Z","modified":"2025-06-13T18:07:37Z","title":"XWiki allows remote code execution through preview of XClass changes in AWM editor","vendor":"xwiki","product":"xwiki-platform","tier":"tail","description":{"text":"XWiki is an open-source wiki software platform. Any XWiki user with edit right on at least one App Within Minutes application (the default for all users XWiki) can obtain programming right/perform remote code execution by editing the application. This vulnerability has been fixed in XWiki 17.0.0, 16.4.7, and 16.10.3.","provenance":"source","from":"CVE.org"},"cvss":{"score":8.7,"severity":"HIGH","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00749,"percentile":0.54765,"provenance":"source"},"cwes":[{"id":"CWE-863","name":"Incorrect Authorization"}],"references":[{"url":"https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-jp4x-w9cj-97q7","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/xwiki/xwiki-platform/commit/ef978315649cf83eae396021bb33603a1a5f7e42","tags":["x_refsource_MISC"]},{"url":"https://jira.xwiki.org/browse/XWIKI-22719","tags":["x_refsource_MISC"]}],"priority":{"score":17.0,"factors":[{"name":"EPSS percentile","points":10.95},{"name":"CVSS severity","points":6.09}]},"vendorSlug":"xwiki","affectedVersions":[{"vendor":"xwiki","product":"xwiki-platform","versions":[">= 7.2-milestone-2, < 16.4.7",">= 16.5.0-rc-1, < 16.10.3",">= 17.0.0-rc-1, < 17.0.0"]}],"affected":[{"ecosystem":"Maven","package":"org.xwiki.platform:xwiki-platform-oldcore","vulnerableRanges":[">=7.2-milestone-2, <16.4.7",">=16.5.0-rc-1, <16.10.3",">=17.0.0-rc-1, <17.0.0"],"patched":["16.4.7","16.10.3","17.0.0"],"from":["GHSA-jp4x-w9cj-97q7"],"provenance":"source"}],"euvd":{"id":"EUVD-2025-18297","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2024-43400","published":"2024-08-19","fixed":"16.0.0","kev":false},{"cve":"CVE-2025-32968","published":"2025-04-23","fixed":"16.10.1","kev":false},{"cve":"CVE-2024-56158","published":"2025-06-12","fixed":"16.10.2","kev":false,"link":{"from":"CVE-2024-56158","to":"CVE-2025-49586","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.xwiki.platform:xwiki-platform-oldcore","fromFixed":"16.10.2","toFixed":"16.10.3","daysApart":1}]}},{"cve":"CVE-2025-49586","published":"2025-06-13","fixed":"17.0.0","kev":false},{"cve":"CVE-2025-54124","published":"2025-08-05","fixed":"17.2.0-rc-1","kev":false,"link":{"from":"CVE-2025-49586","to":"CVE-2025-54124","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.xwiki.platform:xwiki-platform-oldcore","fromFixed":"17.0.0","toFixed":"17.2.0-rc-1","daysApart":53},{"kind":"version-step","provenance":"source","package":"Maven:org.xwiki.platform:xwiki-platform-oldcore","fromFixed":"16.10.3","toFixed":"16.10.5","daysApart":53}]}},{"cve":"CVE-2025-54125","published":"2025-08-05","fixed":"17.2.0-rc-1","kev":false,"link":{"from":"CVE-2025-49586","to":"CVE-2025-54125","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.xwiki.platform:xwiki-platform-oldcore","fromFixed":"17.0.0","toFixed":"17.2.0-rc-1","daysApart":53},{"kind":"version-step","provenance":"source","package":"Maven:org.xwiki.platform:xwiki-platform-oldcore","fromFixed":"16.10.3","toFixed":"16.10.5","daysApart":53}]}},{"cve":"CVE-2025-54385","published":"2025-07-26","fixed":"17.3.0-rc-1","kev":false}],"package":"Maven:org.xwiki.platform:xwiki-platform-oldcore"}}