Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2025-49582

23
FAUCET Score

CVE-2025-49582 describes an incomplete rights analysis vulnerability in XWiki, affecting versions prior to 16.4.7, 16.10.3, and 17.0.0. Attackers with low privileges could hide malicious script macros by using non-lowercase parameters or unanalyzed macro parameters, including those containing arbitrary XWiki syntax. This vulnerability carries a CVSS score of 8.0 (High) due to its network-based attack vector, low attack complexity, and potential for remote code execution (RCE) if a user with programming rights subsequently edits the compromised page. There is currently no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE.

Impacted Technologies

VendorProductVersion(s)CPE
>= 15.9, < 16.4.7CPE matchmatch criteria
cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*
>= 16.5.0, < 16.10.3CPE matchmatch criteria
cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*
17.0.0CPE matchmatch criteria
cpe:2.3:a:xwiki:xwiki:17.0.0:rc1:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 4.0

8.6HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector
NETWORK
Attack Complexity
LOW
Attack Requirements
NONE
Privileges Required
LOW
User Interaction
PASSIVE
VS Confidentiality
HIGH
VS Integrity
HIGH
VS Availability
HIGH
SS Confidentiality
NONE
SS Integrity
NONE
SS Availability
NONE
Exploit Maturity
NOT_DEFINED
CvssVersion
4.0

Exploit Intelligence

EPSS Score
0.72%
Probability of exploitation in next 30 days
EPSS Percentile
50.0%
Percentile rank of EPSS score among Peer Group
As of 2026-07-27
Model: v2026.06.15
This CVE's current EPSS score of 0.0072 is in the 65th percentile among its peer group of 890 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.3 Bluesky, 0.1 Mastodon, and 0.1 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (13)

github_advisorypatch availablevia nvd_reference
View patch
mavenpatch availablevia ghsa
Product: org.xwiki.platform:xwiki-platform-rendering-xwikiFixed in: 16.10.3
mavenpatch availablevia ghsa
Product: org.xwiki.platform:xwiki-platform-rendering-xwikiFixed in: 17.0.0
mavenpatch availablevia ghsa
Product: org.xwiki.platform:xwiki-platform-rendering-macro-cacheFixed in: 16.4.7
mavenpatch availablevia ghsa
Product: org.xwiki.platform:xwiki-platform-rendering-macro-cacheFixed in: 16.10.3
mavenpatch availablevia ghsa
Product: org.xwiki.platform:xwiki-platform-rendering-macro-cacheFixed in: 17.0.0
mavenpatch availablevia ghsa
Product: org.xwiki.platform:xwiki-platform-rendering-xwikiFixed in: 16.4.7
mavenpatch availablevia ghsa
Product: org.xwiki.platform:xwiki-platform-security-requiredrights-defaultFixed in: 16.10.3
mavenpatch availablevia ghsa
Product: org.xwiki.platform:xwiki-platform-security-requiredrights-defaultFixed in: 17.0.0
mavenpatch availablevia ghsa
Product: org.xwiki.platform:xwiki-platform-rendering-macro-contextFixed in: 16.4.7
mavenpatch availablevia ghsa
Product: org.xwiki.platform:xwiki-platform-rendering-macro-contextFixed in: 16.10.3
mavenpatch availablevia ghsa
Product: org.xwiki.platform:xwiki-platform-rendering-macro-contextFixed in: 17.0.0
mavenpatch availablevia ghsa
Product: org.xwiki.platform:xwiki-platform-security-requiredrights-defaultFixed in: 16.4.7

Vendor Advisories (1)

mavenGHSA-c32m-27pj-4xcjhigh

XWiki's required right warnings for macros are incomplete

Jun 13, 2025

References

github.com / xwiki/xwiki-platform/commit/0a705e8e253cb871b804e25c53b2bde879c886bd
Patch
github.com / xwiki/xwiki-platform/commit/3d451e957fe2b14459e9ac64172b4a0e4c46971c
Patch
github.com / xwiki/xwiki-platform/commit/abdcefc0db27035b67329add836fd683e0cf92b8
Patch
github.com / xwiki/xwiki-platform/commit/cc74dc802efe0e2d3fa2ba3355dbadc51c5fd8c7
Patch
github.com / xwiki/xwiki-platform/security/advisories/GHSA-c32m-27pj-4xcj
Vendor Advisory
jira.xwiki.org / browse/XWIKI-22758
ExploitIssue TrackingVendor Advisory
jira.xwiki.org / browse/XWIKI-22759
ExploitIssue TrackingVendor Advisory
jira.xwiki.org / browse/XWIKI-22763
ExploitIssue TrackingVendor Advisory
jira.xwiki.org / browse/XWIKI-22799
ExploitIssue TrackingVendor Advisory