{"id":"CVE-2025-49580","summary":"XWiki allows privilege escalation through link refactoring","details":"XWiki is a generic wiki platform. From 8.2 and 7.4.5 until 17.1.0-rc-1, 16.10.4, and 16.4.7, pages can gain script or programming rights when they contain a link and the target of the link is renamed or moved. This might lead to execution of scripts contained in xobjects that should have never been executed. This vulnerability is fixed in 17.1.0-rc-1, 16.10.4, and 16.4.7.","aliases":["GHSA-jm43-hrq7-r7w6"],"modified":"2026-08-12T14:52:42.743886Z","published":"2025-06-13T15:45:58.451Z","database_specific":{"cwe_ids":["CWE-266"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/49xxx/CVE-2025-49580.json","cna_assigner":"GitHub_M"},"references":[{"type":"WEB","url":"https://jira.xwiki.org/browse/XWIKI-22836"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/49xxx/CVE-2025-49580.json"},{"type":"ADVISORY","url":"https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-jm43-hrq7-r7w6"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-49580"},{"type":"FIX","url":"https://github.com/xwiki/xwiki-platform/commit/ab209acd780da69a4c5ff77ff011efd698273cec"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/xwiki/xwiki-commons","events":[{"introduced":"09d8d9877b04a5183281ed3f52d9997eea5a1d69"},{"fixed":"c3bb3381253c71df533fe0c31a02d3ce1e04bae7"},{"introduced":"526fcc68b3f75862a2af7395b5a6dfdd3d2166a5"},{"fixed":"413a45b9a7643cc3d1451364d5374f4f11229e38"},{"introduced":"e84d9bd1b4c0c8219597e10acfd8fbd692416294"},{"fixed":"7f1dd9fba90aca38f2ab8d5325bf93c24543a730"}],"database_specific":{"cpe":"cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"7.4.5"},{"fixed":"16.4.7"},{"introduced":"16.5.0"},{"fixed":"16.10.4"},{"introduced":"17.0.0"},{"fixed":"17.1.0"}],"source":"CPE_RANGE"}},{"type":"GIT","repo":"https://github.com/xwiki/xwiki-platform","events":[{"introduced":"565f76b670142f39de4e38f7dcc71deee9d2376f"},{"fixed":"f5a9a0762750936523187286919ec4c1892d6fea"},{"introduced":"177e524c2e218fe5de776619271b7cd12c929488"},{"fixed":"02a3be6e06c5af8f157434daf760396c36726500"},{"introduced":"7edb5b7d98170ec081c7e30237971d7dfb8a4401"},{"fixed":"30daaf6500353c1615bf54ffc6fa95e769c2b82a"},{"fixed":"ab209acd780da69a4c5ff77ff011efd698273cec"}],"database_specific":{"cpe":"cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"7.4.5"},{"fixed":"16.4.7"},{"introduced":"16.5.0"},{"fixed":"16.10.4"},{"introduced":"17.0.0"},{"fixed":"17.1.0"}],"source":["CPE_RANGE","REFERENCES"]}}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-49580.json","vanir_signatures_modified":"2026-08-12T14:52:42Z","vanir_signatures":[{"signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/ab209acd780da69a4c5ff77ff011efd698273cec","target":{"file":"xwiki-platform-core/xwiki-platform-refactoring/xwiki-platform-refactoring-default/src/test/java/org/xwiki/refactoring/internal/DefaultReferenceUpdaterTest.java","function":"updateRelativeLinksAcrossWikis"},"deprecated":false,"digest":{"length":2693,"function_hash":"296892834126885246689336097322674796483"},"id":"CVE-2025-49580-06d20559"},{"id":"CVE-2025-49580-1dceaad7","signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/ab209acd780da69a4c5ff77ff011efd698273cec","target":{"file":"xwiki-platform-core/xwiki-platform-refactoring/xwiki-platform-refactoring-default/src/test/java/org/xwiki/refactoring/internal/DefaultReferenceUpdaterTest.java"},"deprecated":false,"digest":{"line_hashes":["176080603180290557542261410259636370758","91448260378889329232059815118329461123","148198789624309278293121328221306356001","86696356611244698194613953235628379421","185030167114738536844852937362238142505","169472579327801929478661899990183455022","319987729733840722074161391084793741907","298451332502795053077234733034931599365","270949364469061243529634551936223563060","72742153606414751669378209928099621200","206477920477247793721059400762587792919","56420806432106114253796782112587217639","164060107665479678998038626365609126551","191900461202964757487020765787929782365","184979569613896179418613298135841026176","273231106673826481387160274115580964226","21960593709280208804787295249332605162","330394005693938744848257303423339723567","30522095002878160774447108008755277001","188835721887392240266835599509391455298","313278556072637279413973395010327928695","287155895871104929236070498641506004730","126783517359411255727925434982031657297","102718456230584493716033402685655813526","168068006351973159228073675352280299250","219605022615795774468703377686063210790","312579241920501183328017009136519662907","127434488242427140287733722455203925699","247729825669650903126988447671597189623","162905777338698421445199968394104453475","237026466521171137730467097796733479516","45600657658682459397339558243554178192","14325293940602472573684245334205939571","106529609420141026594252643277000749170","312579241920501183328017009136519662907","156039326260923426964927154427214925861","159216903599791769797972861174419515050","78855553776960622223901435224631275848","217262533159183871820593022477273593370","235090525660310932421221718383573398124","127390418900170946519363924332991274283","91492639802201264809658305062301062268","124440576430565900628801369431066679676","25497585769388321508378479797444130633","160343102062433851692596992950656579064","7512437442602238234727886043558604775","232219079229314030966250604319309090367","2302603167334537825025336651184906950","127390418900170946519363924332991274283","91492639802201264809658305062301062268","124440576430565900628801369431066679676","169887272022431582726046155802703891572","256598295218982891316890258597141624362","32673263989631000910840257910388260492","109418525925836973337461362998737609157","190001021110836726362141153238240339170","127390418900170946519363924332991274283","91492639802201264809658305062301062268","124440576430565900628801369431066679676","211765949120895419546213029758633954296","323248485402883718787364463759567690001","37868331990405411331224604284442182281","200977063028844414171494153070360851881","257969238311797877916417003926996341374","127390418900170946519363924332991274283","91492639802201264809658305062301062268","124440576430565900628801369431066679676","283827500837735914849945791932589848373","269876973930956847096836865138138147883","145193497543344398896125059199759458191","190795393518495651715981419172982692765","32133095363641012855228224869662379288","127390418900170946519363924332991274283","91492639802201264809658305062301062268","124440576430565900628801369431066679676","47038369548726442004084979181064105563","226233472571759720481355670971152818363","137753203331942739119229316545166838690","279692423342919388436751429537837666032","313948152105223557578240611612830595073","127390418900170946519363924332991274283","91492639802201264809658305062301062268","124440576430565900628801369431066679676","6139975871424847271231242269752907481","25459100779809707042946463892313551935","208193603570493596577093723092250576961","164671723365475009359398875409766006828","281885086679911463927170070444456334453","130221501325194525471296094384346891020","196248245982092214793206739961966402585","23152579549143361888073269812076412689","127825708736253156600405406097305022646","147876731809715230054033326135363737427","147065971474256361588145033959503236422","55799733531605044114683661473352612303","194631018743326092463080266910650477925","202375667294116024208185042124546443849","90234813105458395958473243052244891902","198701363698160816340971395138502551875","249477768953551354709467181656629092064","149827139114549480531817888974838147165","257065175482790341995573255280305425075","164222978500802744206401898510032675812","313490020589255728195704585435613578100","32176232175054956401626779965185188865","127390418900170946519363924332991274283","91492639802201264809658305062301062268","124440576430565900628801369431066679676","241790669383235044736347706432128519468","169586037252700498540146799964793188862","163878870132862694000972965345414407655","272908233960188287537804908566123916273","245416791808334579312322127846977239428","145980974762331530664261717245286289030","219098577489470577076351512050085375898","164516439812578057812092657536280248205","280381826365949724899881060707503015749","330440353750000887841515030754860386053","119729021472118921609792274524405810191","278803086748130408956902362835272029503","320978145929299669999799488310534409010","163524277728337027441179969944468086844","225106390427853658954743946946298545384","310194429194609025922257404268112159386","89860179730692010655520879247287344707","127684445397770995322965942715538205455","224933088080543933445895625640320969853","189798401644257148720100871706228776302","67202113400062967653247674261307304970","259800634408260545718318248858772838249","155742261525956267112981017133119044157","310826211319374026782668833772737607349","310699642529998408429171409964973046169","29586160841738678292830329830688133908","38102974176055508503793983480880902020","224653315953799214999879978931393033486"],"threshold":0.9}},{"source":"https://github.com/xwiki/xwiki-platform/commit/ab209acd780da69a4c5ff77ff011efd698273cec","target":{"file":"xwiki-platform-core/xwiki-platform-refactoring/xwiki-platform-refactoring-default/src/test/java/org/xwiki/refactoring/internal/DefaultReferenceUpdaterTest.java","function":"updateAttachments"},"deprecated":false,"digest":{"function_hash":"230801043884742862008795135754330965230","length":2119},"id":"CVE-2025-49580-3ad60def","signature_type":"Function","signature_version":"v1"},{"id":"CVE-2025-49580-44746be0","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/ab209acd780da69a4c5ff77ff011efd698273cec","target":{"file":"xwiki-platform-core/xwiki-platform-refactoring/xwiki-platform-refactoring-default/src/test/java/org/xwiki/refactoring/internal/DefaultReferenceUpdaterTest.java","function":"updateRelativeLinks"},"deprecated":false,"digest":{"function_hash":"325793366384932067567243203539559214493","length":5417}},{"target":{"file":"xwiki-platform-core/xwiki-platform-refactoring/xwiki-platform-refactoring-default/src/test/java/org/xwiki/refactoring/internal/DefaultReferenceUpdaterTest.java","function":"renameAttachment"},"deprecated":false,"digest":{"function_hash":"77135979315393802777618869102526684899","length":1809},"id":"CVE-2025-49580-4728bdc4","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/ab209acd780da69a4c5ff77ff011efd698273cec"},{"id":"CVE-2025-49580-51ceb802","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/ab209acd780da69a4c5ff77ff011efd698273cec","target":{"file":"xwiki-platform-core/xwiki-platform-refactoring/xwiki-platform-refactoring-default/src/test/java/org/xwiki/refactoring/internal/DefaultReferenceUpdaterTest.java","function":"verifyDocumentSave"},"deprecated":false,"digest":{"length":611,"function_hash":"202760741172763210438972053868958289595"}},{"target":{"file":"xwiki-platform-core/xwiki-platform-refactoring/xwiki-platform-refactoring-default/src/main/java/org/xwiki/refactoring/internal/DefaultReferenceUpdater.java","function":"renameLinks"},"deprecated":false,"digest":{"function_hash":"273447432492030098157633566654173677480","length":1533},"id":"CVE-2025-49580-5cef0a4c","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/ab209acd780da69a4c5ff77ff011efd698273cec"},{"id":"CVE-2025-49580-5ec5dd1b","signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/ab209acd780da69a4c5ff77ff011efd698273cec","target":{"file":"xwiki-platform-core/xwiki-platform-refactoring/xwiki-platform-refactoring-default/src/main/java/org/xwiki/refactoring/internal/DefaultReferenceUpdater.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["3998874320505048898743109019001565072","333345106508820733278567391929957257193","119172336198050147422198784685791906704","86696356611244698194613953235628379421","161688590973927195081294226397252063157","210575195088937699925084149003577988719","329558073255489494418509748944767597453","250667260636142156177234392786770121575","36361363467520010697051636802012073898","265591989651849109631578794145050883611","141283674064146071050477884146308015800","137604968254324966114344524440233118039","5729129465270358424199776016267791244","224216737906972158231673154368366631401","329598171378584993287062252927609881813","451651753292563896459556098457630367","196214209452895902858102792359590850069","285342335585092880662685003975615623792","278954104234554164126871030219705690826","31074591746180989966498954724614075032","28696154228420594823672142384289681397","203041186992174342124532246711915418993","325500993518052464518364761043168426698","314856109183652018798333823584826208266","89175494252297351347028100649553636069","112538316374749943835116034472856921448","207546965171624519774841061624334653349"]}},{"source":"https://github.com/xwiki/xwiki-platform/commit/ab209acd780da69a4c5ff77ff011efd698273cec","target":{"file":"xwiki-platform-core/xwiki-platform-flamingo/xwiki-platform-flamingo-skin/xwiki-platform-flamingo-skin-test/xwiki-platform-flamingo-skin-test-docker/src/test/it/org/xwiki/flamingo/test/docker/RenamePageIT.java"},"deprecated":false,"digest":{"line_hashes":["301349080362396737969004881125738821597","1479984336321597782906495325084418913"],"threshold":0.9},"id":"CVE-2025-49580-5ee571d2","signature_type":"Line","signature_version":"v1"},{"digest":{"function_hash":"115342912769273446993572521738548143498","length":2510},"id":"CVE-2025-49580-6667a3bd","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/ab209acd780da69a4c5ff77ff011efd698273cec","target":{"file":"xwiki-platform-core/xwiki-platform-refactoring/xwiki-platform-refactoring-default/src/test/java/org/xwiki/refactoring/internal/DefaultReferenceUpdaterTest.java","function":"renameNonTerminalDocumentLinks"},"deprecated":false},{"id":"CVE-2025-49580-6b9000a2","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/ab209acd780da69a4c5ff77ff011efd698273cec","target":{"file":"xwiki-platform-core/xwiki-platform-refactoring/xwiki-platform-refactoring-default/src/test/java/org/xwiki/refactoring/internal/DefaultReferenceUpdaterTest.java","function":"updateFromMacros"},"deprecated":false,"digest":{"function_hash":"223088660807537103812553219960681925877","length":2678}},{"signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/ab209acd780da69a4c5ff77ff011efd698273cec","target":{"file":"xwiki-platform-core/xwiki-platform-refactoring/xwiki-platform-refactoring-default/src/test/java/org/xwiki/refactoring/internal/DefaultReferenceUpdaterTest.java","function":"updateAndTranslations"},"deprecated":false,"digest":{"function_hash":"289474250154335522656283405294684821416","length":2570},"id":"CVE-2025-49580-a01df8b3","signature_type":"Function"},{"digest":{"function_hash":"327603636882249366923129912960676454714","length":2876},"id":"CVE-2025-49580-c1bfd9f7","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/ab209acd780da69a4c5ff77ff011efd698273cec","target":{"file":"xwiki-platform-core/xwiki-platform-refactoring/xwiki-platform-refactoring-default/src/test/java/org/xwiki/refactoring/internal/DefaultReferenceUpdaterTest.java","function":"update"},"deprecated":false},{"deprecated":false,"digest":{"length":1787,"function_hash":"273171669458005777616022962247525791922"},"id":"CVE-2025-49580-c8a7ae15","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/ab209acd780da69a4c5ff77ff011efd698273cec","target":{"file":"xwiki-platform-core/xwiki-platform-refactoring/xwiki-platform-refactoring-default/src/test/java/org/xwiki/refactoring/internal/DefaultReferenceUpdaterTest.java","function":"renameImage"}},{"deprecated":false,"digest":{"function_hash":"250138363258119421562254685784386553692","length":652},"id":"CVE-2025-49580-d29c07de","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/ab209acd780da69a4c5ff77ff011efd698273cec","target":{"file":"xwiki-platform-core/xwiki-platform-refactoring/xwiki-platform-refactoring-default/src/test/java/org/xwiki/refactoring/internal/DefaultReferenceUpdaterTest.java","function":"beforeEach"}},{"deprecated":false,"digest":{"function_hash":"140843675360214481386357036159146708998","length":2006},"id":"CVE-2025-49580-d6bfaf3b","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/ab209acd780da69a4c5ff77ff011efd698273cec","target":{"file":"xwiki-platform-core/xwiki-platform-refactoring/xwiki-platform-refactoring-default/src/test/java/org/xwiki/refactoring/internal/DefaultReferenceUpdaterTest.java","function":"updateFromLinksAndMacros"}},{"deprecated":false,"digest":{"function_hash":"286469387921910530526279596544900216672","length":300},"id":"CVE-2025-49580-e19733da","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/ab209acd780da69a4c5ff77ff011efd698273cec","target":{"file":"xwiki-platform-core/xwiki-platform-refactoring/xwiki-platform-refactoring-default/src/main/java/org/xwiki/refactoring/internal/DefaultReferenceUpdater.java","function":"saveDocumentPreservingContentAuthor"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/ab209acd780da69a4c5ff77ff011efd698273cec","target":{"file":"xwiki-platform-core/xwiki-platform-refactoring/xwiki-platform-refactoring-default/src/test/java/org/xwiki/refactoring/internal/DefaultReferenceUpdaterTest.java","function":"renameNonTerminalToTerminalDocumentLinks"},"deprecated":false,"digest":{"function_hash":"126719337316968255889306392803018919975","length":2497},"id":"CVE-2025-49580-eac8e536"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}]}