CVE-2025-49582

Workarounds

We're not aware of any workarounds except for being careful when editing content authored by untrusted users.

References

• https://jira.xwiki.org/browse/XWIKI-22763
• https://jira.xwiki.org/browse/XWIKI-22759
• https://jira.xwiki.org/browse/XWIKI-22758
• https://jira.xwiki.org/browse/XWIKI-22799
• https://github.com/xwiki/xwiki-platform/commit/abdcefc0db27035b67329add836fd683e0cf92b8
• https://github.com/xwiki/xwiki-platform/commit/cc74dc802efe0e2d3fa2ba3355dbadc51c5fd8c7
• https://github.com/xwiki/xwiki-platform/commit/0a705e8e253cb871b804e25c53b2bde879c886bd
• https://github.com/xwiki/xwiki-platform/commit/3d451e957fe2b14459e9ac64172b4a0e4c46971c

When editing content that contains "dangerous" macros like malicious script macros that were authored by a user with fewer rights, XWiki warns about the execution of these macros since XWiki 15.9RC1. These required rights analyzers that trigger these warnings are incomplete, allowing an attacker to hide malicious content. For most macros, the existing analyzers don't consider non-lowercase parameters. Further, most macro parameters that can contain XWiki syntax like titles of information boxes weren't analyzed at all. Similarly, the "source" parameters of the content and context macro weren't anylzed even though they could contain arbitrary XWiki syntax. In the worst case, this could allow a malicious to add malicious script macros including Groovy or Python macros to a page that are then executed after another user with programming righs edits the page, thus allowing remote code execution.

Kodem intelligence

The required rights analyzers have been made more robust and extended to cover those cases in XWiki 16.4.7, 16.10.3 and 17.0.0.

1. What is CVE-2025-49582? CVE-2025-49582 is a high-severity security vulnerability in org.xwiki.platform:xwiki-platform-rendering-xwiki (maven), affecting versions >= 15.9-rc-1, < 16.4.7. It is fixed in 16.4.7, 16.10.3, 17.0.0.
2. Which packages are affected by CVE-2025-49582?
   • org.xwiki.platform:xwiki-platform-rendering-xwiki (maven) (versions >= 15.9-rc-1, < 16.4.7)
   • org.xwiki.platform:xwiki-platform-rendering-macro-cache (maven) (versions >= 15.9-rc-1, < 16.4.7)
   • org.xwiki.platform:xwiki-platform-security-requiredrights-default (maven) (versions >= 15.9-rc-1, < 16.4.7)
   • org.xwiki.platform:xwiki-platform-rendering-macro-context (maven) (versions >= 15.9-rc-1, < 16.4.7)
3. Is there a fix for CVE-2025-49582? Yes. CVE-2025-49582 is fixed in 16.4.7, 16.10.3, 17.0.0. Upgrade to this version or later.
4. Is CVE-2025-49582 exploitable, and should I be worried? Whether CVE-2025-49582 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
5. What actually determines whether CVE-2025-49582 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
6. How do I fix CVE-2025-49582?
   • Upgrade org.xwiki.platform:xwiki-platform-rendering-xwiki to 16.4.7 or later
   • Upgrade org.xwiki.platform:xwiki-platform-rendering-xwiki to 16.10.3 or later
   • Upgrade org.xwiki.platform:xwiki-platform-rendering-xwiki to 17.0.0 or later
   • Upgrade org.xwiki.platform:xwiki-platform-rendering-macro-cache to 16.4.7 or later
   • Upgrade org.xwiki.platform:xwiki-platform-rendering-macro-cache to 16.10.3 or later
   • Upgrade org.xwiki.platform:xwiki-platform-rendering-macro-cache to 17.0.0 or later
   • Upgrade org.xwiki.platform:xwiki-platform-security-requiredrights-default to 16.4.7 or later
   • Upgrade org.xwiki.platform:xwiki-platform-security-requiredrights-default to 16.10.3 or later
   • Upgrade org.xwiki.platform:xwiki-platform-security-requiredrights-default to 17.0.0 or later
   • Upgrade org.xwiki.platform:xwiki-platform-rendering-macro-context to 16.4.7 or later
   • Upgrade org.xwiki.platform:xwiki-platform-rendering-macro-context to 16.10.3 or later
   • Upgrade org.xwiki.platform:xwiki-platform-rendering-macro-context to 17.0.0 or later