{"id":"CVE-2025-49582","summary":"XWiki's required right warnings for macros are incomplete","details":"XWiki is a generic wiki platform. When editing content that contains \"dangerous\" macros like malicious script macros that were authored by a user with fewer rights, XWiki warns about the execution of these macros since XWiki 15.9RC1. These required rights analyzers that trigger these warnings are incomplete, allowing an attacker to hide malicious content. For most macros, the existing analyzers don't consider non-lowercase parameters. Further, most macro parameters that can contain XWiki syntax like titles of information boxes weren't analyzed at all. Similarly, the \"source\" parameters of the content and context macro weren't anylzed even though they could contain arbitrary XWiki syntax. In the worst case, this could allow a malicious to add malicious script macros including Groovy or Python macros to a page that are then executed after another user with programming righs edits the page, thus allowing remote code execution. The required rights analyzers have been made more robust and extended to cover those cases in XWiki 16.4.7, 16.10.3 and 17.0.0.","aliases":["GHSA-c32m-27pj-4xcj"],"modified":"2026-08-12T15:16:36.008792Z","published":"2025-06-13T16:41:45.131Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/49xxx/CVE-2025-49582.json","cna_assigner":"GitHub_M","cwe_ids":["CWE-357"]},"references":[{"type":"WEB","url":"https://jira.xwiki.org/browse/XWIKI-22758"},{"type":"WEB","url":"https://jira.xwiki.org/browse/XWIKI-22759"},{"type":"WEB","url":"https://jira.xwiki.org/browse/XWIKI-22763"},{"type":"WEB","url":"https://jira.xwiki.org/browse/XWIKI-22799"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/49xxx/CVE-2025-49582.json"},{"type":"ADVISORY","url":"https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-c32m-27pj-4xcj"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-49582"},{"type":"FIX","url":"https://github.com/xwiki/xwiki-platform/commit/0a705e8e253cb871b804e25c53b2bde879c886bd"},{"type":"FIX","url":"https://github.com/xwiki/xwiki-platform/commit/3d451e957fe2b14459e9ac64172b4a0e4c46971c"},{"type":"FIX","url":"https://github.com/xwiki/xwiki-platform/commit/abdcefc0db27035b67329add836fd683e0cf92b8"},{"type":"FIX","url":"https://github.com/xwiki/xwiki-platform/commit/cc74dc802efe0e2d3fa2ba3355dbadc51c5fd8c7"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/xwiki/xwiki-commons","events":[{"introduced":"943b4a6a0a0e2b9b94f6f184e823f82b262ea8d3"},{"fixed":"c3bb3381253c71df533fe0c31a02d3ce1e04bae7"},{"introduced":"526fcc68b3f75862a2af7395b5a6dfdd3d2166a5"},{"fixed":"1b4e258d6d1cbc10a803d3e071d038edb2d28b97"}],"database_specific":{"cpe":"cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"15.9"},{"fixed":"16.4.7"},{"introduced":"16.5.0"},{"fixed":"16.10.3"}],"source":"CPE_RANGE"}},{"type":"GIT","repo":"https://github.com/xwiki/xwiki-platform","events":[{"introduced":"7a8f9b1236bc9271b607fb92e700377e37f67cf2"},{"fixed":"f5a9a0762750936523187286919ec4c1892d6fea"},{"introduced":"177e524c2e218fe5de776619271b7cd12c929488"},{"fixed":"8cde0f326b60732330378e3ac10c630021e9cad7"},{"fixed":"0a705e8e253cb871b804e25c53b2bde879c886bd"},{"fixed":"3d451e957fe2b14459e9ac64172b4a0e4c46971c"},{"fixed":"abdcefc0db27035b67329add836fd683e0cf92b8"},{"fixed":"cc74dc802efe0e2d3fa2ba3355dbadc51c5fd8c7"}],"database_specific":{"extracted_events":[{"introduced":"15.9"},{"fixed":"16.4.7"},{"introduced":"16.5.0"},{"fixed":"16.10.3"}],"source":["CPE_RANGE","REFERENCES"],"cpe":"cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*"}}],"database_specific":{"vanir_signatures_modified":"2026-08-12T15:16:36Z","vanir_signatures":[{"deprecated":false,"digest":{"function_hash":"235305143574982914062327195251672197676","length":371},"id":"CVE-2025-49582-003172ca","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/3d451e957fe2b14459e9ac64172b4a0e4c46971c","target":{"file":"xwiki-platform-core/xwiki-platform-rendering/xwiki-platform-rendering-macros/xwiki-platform-rendering-macro-cache/src/test/java/org/xwiki/rendering/internal/macro/cache/CacheMacroRequiredRightsAnalyzerTest.java","function":"analyze"}},{"deprecated":false,"digest":{"line_hashes":["314155969856412885120243083993630248651","311809464120539603119028463634319108810","249354558512541941452984106101750456969","27798607160872807789407277015796445301","309512082645042633066049800122327940055","264693861861356165565835185706383251252","113428933441516372774335185205627932333","73050983018509363775963728053963682114"],"threshold":0.9},"id":"CVE-2025-49582-024ecbb2","signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/3d451e957fe2b14459e9ac64172b4a0e4c46971c","target":{"file":"xwiki-platform-core/xwiki-platform-rendering/xwiki-platform-rendering-xwiki/src/test/java/org/xwiki/rendering/internal/macro/HTMLMacroRequiredRightsAnalyzerTest.java"}},{"target":{"function":"analyze","file":"xwiki-platform-core/xwiki-platform-rendering/xwiki-platform-rendering-xwiki/src/main/java/org/xwiki/rendering/internal/macro/HTMLMacroRequiredRightsAnalyzer.java"},"deprecated":false,"digest":{"function_hash":"228683720350286898463453930926807511364","length":1306},"id":"CVE-2025-49582-093714cf","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/3d451e957fe2b14459e9ac64172b4a0e4c46971c"},{"id":"CVE-2025-49582-578ad0eb","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/abdcefc0db27035b67329add836fd683e0cf92b8","target":{"file":"xwiki-platform-core/xwiki-platform-security/xwiki-platform-security-requiredrights/xwiki-platform-security-requiredrights-default/src/main/java/org/xwiki/platform/security/requiredrights/internal/analyzer/DefaultMacroBlockRequiredRightAnalyzer.java","function":"analyzeWithExceptions"},"deprecated":false,"digest":{"function_hash":"89628001991822442222256481846658510221","length":706}},{"source":"https://github.com/xwiki/xwiki-platform/commit/abdcefc0db27035b67329add836fd683e0cf92b8","target":{"file":"xwiki-platform-core/xwiki-platform-security/xwiki-platform-security-requiredrights/xwiki-platform-security-requiredrights-default/src/test/java/org/xwiki/platform/security/requiredrights/internal/analyzer/DefaultMacroBlockRequiredRightAnalyzerTest.java"},"deprecated":false,"digest":{"line_hashes":["248683916824713251808258694165541806912","44056805028594856899957420174019387392","40834180126295611909679447539783006959","66601881815802445662856493232493337746","223432701982936772179894690131154626658","46881405650900160231566747181075824113","219109683626831899273207836399267546246","153958849507251931285251424360316496933","214899489810292364316170152957512836842","5252715175168381181687828680346999974","187340939015039383969877410124590671490","97185617565108243134189535769745616331","167548448445891519813624401546977680423","127520936244115035180320097047985844375","138013534232827430511207819947601911051","124127917164446895312977870383198860260","86273418629889509353551665240572117710","235501258910360480652644565262040233010"],"threshold":0.9},"id":"CVE-2025-49582-61774128","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"288661234016873151807248274033087166674","length":265},"id":"CVE-2025-49582-86b34ae5","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/cc74dc802efe0e2d3fa2ba3355dbadc51c5fd8c7","target":{"file":"xwiki-platform-core/xwiki-platform-rendering/xwiki-platform-rendering-macros/xwiki-platform-rendering-macro-context/src/main/java/org/xwiki/rendering/internal/macro/context/ContextMacroRequiredRightsAnalyzer.java","function":"analyze"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/3d451e957fe2b14459e9ac64172b4a0e4c46971c","target":{"file":"xwiki-platform-core/xwiki-platform-rendering/xwiki-platform-rendering-xwiki/src/test/java/org/xwiki/rendering/internal/macro/RawMacroRequiredRightsAnalyzerTest.java","function":"analyze"},"deprecated":false,"digest":{"function_hash":"114822234755268740887288591097314038612","length":552},"id":"CVE-2025-49582-9e86108d"},{"target":{"file":"xwiki-platform-core/xwiki-platform-rendering/xwiki-platform-rendering-xwiki/src/test/java/org/xwiki/rendering/internal/macro/RawMacroRequiredRightsAnalyzerTest.java"},"deprecated":false,"digest":{"line_hashes":["25305908426353763878398429194390914125","332865150289053461404684676758632903552","265850024812684181549162460519693335199","189392902779550771582162657587168978277","229510170235464515500588684549941333616","128047361485415510549636775704409311679","5226644185592764588571845684183702068","54177982657052548832675509133273229775","218673080937962336695974848015384802019","229857287877006771662869513075531530850","216020705131424389594492525578040184075","316130433178470820486338030707106604477","191211726210571023296339153076834185279","242418116089109129569288603725561482975","138008720758359461582554767204055412351","273200265235926291916842403794871440810","139883319948585012142760132510065562303","287853316119256110116906273586994501487","35591650455752599684007489968975589793","307079214305419346160946605468682196431","172728748806944302346583027804269368644","270509232453034733434852948071161111178","11364220766012634427410200514280013241","108095321373035739274672440556915021483","22905499286180078136539466079734569314","200109387836001105431565037607037399641","16070493550151522611214027410020040194","78770856094349735470040919665684681067","86890163251335330102206708858947818164","203155413508646107739008151164809121404"],"threshold":0.9},"id":"CVE-2025-49582-a691d067","signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/3d451e957fe2b14459e9ac64172b4a0e4c46971c"},{"signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/3d451e957fe2b14459e9ac64172b4a0e4c46971c","target":{"file":"xwiki-platform-core/xwiki-platform-rendering/xwiki-platform-rendering-xwiki/src/main/java/org/xwiki/rendering/internal/macro/HTMLMacroRequiredRightsAnalyzer.java"},"deprecated":false,"digest":{"line_hashes":["42412005904802213185269323312139730164","76412558358167331784914680326039449630","230858229873406835534393344686209283206","57608221344348083845724934030115009349","90293501061974149424114955957515306079","194437765982722373176698360048926168386","258414668843908514640089326699810273061","292548552224725043584290325481463506209","89117810523169701177877662900965092225","305030817161272820784748529389283509011","338544266124092163433086475657979482853","232624841672077921831763856816027013717","108587633537507210242609878158511307392"],"threshold":0.9},"id":"CVE-2025-49582-b00baf8e","signature_type":"Line"},{"source":"https://github.com/xwiki/xwiki-platform/commit/3d451e957fe2b14459e9ac64172b4a0e4c46971c","target":{"file":"xwiki-platform-core/xwiki-platform-rendering/xwiki-platform-rendering-macros/xwiki-platform-rendering-macro-cache/src/test/java/org/xwiki/rendering/internal/macro/cache/CacheMacroRequiredRightsAnalyzerTest.java"},"deprecated":false,"digest":{"line_hashes":["195383052062971528290258143037606006974","121147934862293644318223121108061030012","112965115559864019592300372200845883583","105787123406870835022384621319119564932","184475166291282548766627178404940778913","219559118566797664587926251416065009520","236901240113997621676600184576019669883","71304402365093247034470054750937210515","211866269934021298458109792386785474397","284985444740279798696736757844023505266","130031872075398440046210642627985692316","28778134755325173924931364149116929880","270271483860581133720673468683456709941","110991688298404359578470425142360187281","27838123633814278103295413661651828316","181645595592214986386015281388804481518","135066953218804412433623088276744665157","41056096597614283021352793895940833427","59714211986909969146966612398181660584"],"threshold":0.9},"id":"CVE-2025-49582-b462e403","signature_type":"Line","signature_version":"v1"},{"id":"CVE-2025-49582-c71c63cd","signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/3d451e957fe2b14459e9ac64172b4a0e4c46971c","target":{"file":"xwiki-platform-core/xwiki-platform-rendering/xwiki-platform-rendering-xwiki/src/main/java/org/xwiki/rendering/internal/macro/RawMacroRequiredRightsAnalyzer.java"},"deprecated":false,"digest":{"line_hashes":["276738066488381805261157201680718865855","164370008595539341956014735024825611459","262616887426566308977370055165610489664","21318239742178238277394075233369128626","237254102987221103667523445719797555172","330058200322767557362957504587808430898","21627028852512648231067761854713848160","59141606338868174779473946636934870441","143884815482871194234129193299697741884","17155123061976021419691533723293937547","234629842799974531962243726968545354147","130961549466645131151649528901824833994"],"threshold":0.9}},{"target":{"file":"xwiki-platform-core/xwiki-platform-rendering/xwiki-platform-rendering-macros/xwiki-platform-rendering-macro-context/src/main/java/org/xwiki/rendering/internal/macro/context/ContextMacroRequiredRightsAnalyzer.java"},"deprecated":false,"digest":{"line_hashes":["132600938530182733092681992755499536016","13153002476370662215552005562743474463","64736672451221512473442173226846036680","254495155204050035142757874586850118906","338337232763699491287541939066870002567","52557038266222158918529276551484030368","299163024094887182719628010908463316536","148607089551700924669911308494642303386","318854787040316110921491332558118939833","116118932386364336233676448413438587198","164522654837879300440964326983835409563","293505213220487371789295650217783594818","201937082094564569048922355336345256851","295534043666617394366613672871593258178","29012764898561677218470015461307788294"],"threshold":0.9},"id":"CVE-2025-49582-cdeb4fb3","signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/cc74dc802efe0e2d3fa2ba3355dbadc51c5fd8c7"},{"deprecated":false,"digest":{"line_hashes":["292782975728246476210679671676246248877","163438177047017849665783186282390724233","31176276206579177320143055695245481250","148607089551700924669911308494642303386","25495157289446027352244061604805230092","135672579099723442865921284003523498764","149059873497223998984428317533104989185","225402803628712228278794988486832995473","124127917164446895312977870383198860260","110682154092063538200128735432143215632","10649016507255300931040694348268046711","18068771482343736038027688917526224809","276905478166767274820951307698529626567"],"threshold":0.9},"id":"CVE-2025-49582-d02b2198","signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/cc74dc802efe0e2d3fa2ba3355dbadc51c5fd8c7","target":{"file":"xwiki-platform-core/xwiki-platform-rendering/xwiki-platform-rendering-macros/xwiki-platform-rendering-macro-context/src/test/java/org/xwiki/rendering/internal/macro/context/ContextMacroRequiredRightsAnalyzerTest.java"}},{"id":"CVE-2025-49582-d0a016d4","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/3d451e957fe2b14459e9ac64172b4a0e4c46971c","target":{"function":"analyzeTestCases","file":"xwiki-platform-core/xwiki-platform-rendering/xwiki-platform-rendering-xwiki/src/test/java/org/xwiki/rendering/internal/macro/RawMacroRequiredRightsAnalyzerTest.java"},"deprecated":false,"digest":{"length":198,"function_hash":"233829013755286698717352821860120313778"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/abdcefc0db27035b67329add836fd683e0cf92b8","target":{"file":"xwiki-platform-core/xwiki-platform-security/xwiki-platform-security-requiredrights/xwiki-platform-security-requiredrights-default/src/main/java/org/xwiki/platform/security/requiredrights/internal/analyzer/DefaultMacroBlockRequiredRightAnalyzer.java","function":"shouldMacroContentBeParsed"},"deprecated":false,"digest":{"function_hash":"247804012178890485861947138874718954374","length":166},"id":"CVE-2025-49582-d4c61853"},{"digest":{"function_hash":"231430094203034280860472005261255493618","length":157},"id":"CVE-2025-49582-d93188cf","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/3d451e957fe2b14459e9ac64172b4a0e4c46971c","target":{"function":"analyze","file":"xwiki-platform-core/xwiki-platform-rendering/xwiki-platform-rendering-macros/xwiki-platform-rendering-macro-cache/src/main/java/org/xwiki/rendering/internal/macro/cache/CacheMacroRequiredRightsAnalyzer.java"},"deprecated":false},{"signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/3d451e957fe2b14459e9ac64172b4a0e4c46971c","target":{"file":"xwiki-platform-core/xwiki-platform-rendering/xwiki-platform-rendering-macros/xwiki-platform-rendering-macro-cache/src/main/java/org/xwiki/rendering/internal/macro/cache/CacheMacroRequiredRightsAnalyzer.java"},"deprecated":false,"digest":{"line_hashes":["325579037316400982895932797709283550193","99255768894288069419015293147941888353","55225510275208746887944463077340963929","232398720244875866492509754897382133022","84533743630781334150135723516399306299","271602715679328318980623804797119120129","175090837600517967393692228771675653841","176977289759308312455472024779933004596","248614179716427064349976817298301635644"],"threshold":0.9},"id":"CVE-2025-49582-de1febc8","signature_type":"Line"},{"deprecated":false,"digest":{"line_hashes":["212640317525585014960428878892610971769","38007280274902160396293632803830071086","199223639543099459485657674444168982855","25421045979510272820368307634102495184","88398930931839429071252612344221609394","82672814738918513840072475030753854207","281075531710560581128058494792678662934","127942334371151126992624868745973015605","227779521104918090318804153521828306674","111632356791907740519827236041080326430","209977171899804269991537221911262469895","298839521383502405799805654875515750722","239053565274598709827648809835826991913","149319737397567330174205565386869137508","87770959869340425756158690769332165555","115544456197011985989332942471861295035","189534682226434435708798524168451961407","117864180704777753900281286835341206923","125234676716008208853124178379080400295","204904030863125808864821971606313421330"],"threshold":0.9},"id":"CVE-2025-49582-ec86bf04","signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/abdcefc0db27035b67329add836fd683e0cf92b8","target":{"file":"xwiki-platform-core/xwiki-platform-security/xwiki-platform-security-requiredrights/xwiki-platform-security-requiredrights-default/src/main/java/org/xwiki/platform/security/requiredrights/internal/analyzer/DefaultMacroBlockRequiredRightAnalyzer.java"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/3d451e957fe2b14459e9ac64172b4a0e4c46971c","target":{"file":"xwiki-platform-core/xwiki-platform-rendering/xwiki-platform-rendering-xwiki/src/main/java/org/xwiki/rendering/internal/macro/RawMacroRequiredRightsAnalyzer.java","function":"analyze"},"deprecated":false,"digest":{"function_hash":"256488238885253515097908283424624933416","length":361},"id":"CVE-2025-49582-ed5b0ee7"}],"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-49582.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}]}