{"id":"CVE-2025-49586","summary":"XWiki allows remote code execution through preview of XClass changes in AWM editor","details":"XWiki is an open-source wiki software platform. Any XWiki user with edit right on at least one App Within Minutes application (the default for all users XWiki) can obtain programming right/perform remote code execution by editing the application. This vulnerability has been fixed in XWiki 17.0.0, 16.4.7, and 16.10.3.","aliases":["GHSA-jp4x-w9cj-97q7"],"modified":"2026-08-12T15:13:55.679610Z","published":"2025-06-13T17:47:07.105Z","database_specific":{"cwe_ids":["CWE-863"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/49xxx/CVE-2025-49586.json","cna_assigner":"GitHub_M"},"references":[{"type":"WEB","url":"https://jira.xwiki.org/browse/XWIKI-22719"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/49xxx/CVE-2025-49586.json"},{"type":"ADVISORY","url":"https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-jp4x-w9cj-97q7"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-49586"},{"type":"FIX","url":"https://github.com/xwiki/xwiki-platform/commit/ef978315649cf83eae396021bb33603a1a5f7e42"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/xwiki/xwiki-commons","events":[{"introduced":"5c2d4ea599703742ae5325c7707d1ae926d14d6c"},{"fixed":"c3bb3381253c71df533fe0c31a02d3ce1e04bae7"},{"introduced":"526fcc68b3f75862a2af7395b5a6dfdd3d2166a5"},{"fixed":"1b4e258d6d1cbc10a803d3e071d038edb2d28b97"},{"introduced":"6a47dbb7a409ce379e847970388d1f41ece408c1"},{"last_affected":"934bf35fda496c7b91ded00563e2266aaefc21b5"}],"database_specific":{"cpe":["cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*","cpe:2.3:a:xwiki:xwiki:7.2:milestone2:*:*:*:*:*:*","cpe:2.3:a:xwiki:xwiki:7.2:milestone3:*:*:*:*:*:*"],"extracted_events":[{"introduced":"7.3"},{"fixed":"16.4.7"},{"introduced":"16.5.0"},{"fixed":"16.10.3"},{"introduced":"7.2-milestone2"},{"last_affected":"7.2-milestone2"},{"introduced":"7.2-milestone3"},{"last_affected":"7.2-milestone3"}],"source":["CPE_RANGE","CPE_STRING"]}},{"type":"GIT","repo":"https://github.com/xwiki/xwiki-platform","events":[{"introduced":"99fc038a4c63039a4893bdae125c2defa9ddda19"},{"fixed":"f5a9a0762750936523187286919ec4c1892d6fea"},{"introduced":"177e524c2e218fe5de776619271b7cd12c929488"},{"fixed":"8cde0f326b60732330378e3ac10c630021e9cad7"},{"introduced":"195c7ab5c73103368748f201dddbae273ca8576f"},{"fixed":"ef978315649cf83eae396021bb33603a1a5f7e42"}],"database_specific":{"cpe":["cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*","cpe:2.3:a:xwiki:xwiki:7.2:milestone2:*:*:*:*:*:*","cpe:2.3:a:xwiki:xwiki:7.2:milestone3:*:*:*:*:*:*"],"extracted_events":[{"introduced":"7.3"},{"fixed":"16.4.7"},{"introduced":"16.5.0"},{"fixed":"16.10.3"},{"introduced":"7.2-milestone2"},{"last_affected":"7.2-milestone2"},{"introduced":"7.2-milestone3"},{"last_affected":"7.2-milestone3"}],"source":["CPE_RANGE","CPE_STRING","REFERENCES"]}}],"versions":["7.2-milestone2","7.2-milestone3"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-49586.json","vanir_signatures_modified":"2026-08-12T15:13:55Z","vanir_signatures":[{"digest":{"line_hashes":["88056371801129439393603216964005880960","243874483758298929353018740184486391721","157154770268637902133741951968906361400","222230847715378379706470041518623815940","257987567835481188112663690216475254695","14178863615932029679974832388040924610","159375539112173457013987556070739220251","169630682598187821745413707582583576333","53865781580485702225522380105047968218","152761112594932920870077440317867397416","101774292180674610088893663042953797200","324187643284816238668183484813826028693","114065041320961532354224894364447811351","4385708028378267392098971724499126632","181208447682209001316245315671685470233","295407642657319325283065223690371837990","1334653094449167452274428159926731720","204419657364758336765445464259318755118","134156539473107085282535521100768221026","99972270439302202698232084448185645955","26650894625846250765989164977446986539","227741972265079575059542753098839707357","92474453688505862599522123567797750238","334305464701464106636828679690766468273","127020532283632265904975322883311643544","131234046097332997579785053609329483392","259468903975290189077467597873908161025","62488527098462729328611099232829122854","138657341072624268514707363512864321771","214972680125672562606570230356861888948","180563482172875573204987040367149155908","245430175325478782582825497781938335876","329811685623014983799127915380322501817","191691866896582082463447956084377266243","62652287021849066565384271522563502059","327131720233497180801278307421451701604","168218157939892447303071095930853194344","208326756325612507473000390708659468750","41879863245529428531972832792832487149","123183397650040630516201246693274934555","80098788164363811684597407826397290230","251311883521115400868068540550857238808","169892318178119867396634793531462932741","26575517123589722828344753722464222444","55298824493271449317421094744909481270","184888802040989885714038509878693235968","326765963262692642006399677692880333752","152509382163989857048201475788331401040","245100065397562093816285128127125755268"],"threshold":0.9},"id":"CVE-2025-49586-15abc932","signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/ef978315649cf83eae396021bb33603a1a5f7e42","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/test/java/com/xpn/xwiki/objects/classes/PropertyClassTest.java"},"deprecated":false},{"signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/ef978315649cf83eae396021bb33603a1a5f7e42","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/objects/classes/PropertyClass.java"},"deprecated":false,"digest":{"line_hashes":["172166885950853625472209083528346364527","310123872512017473080959231745089015074","120602934919254131372164579458433181029","70408719690255586196329936435701511804","274033723923858593887719092643275116194","290103087779532091558248290856589718973","252541003888067422865556826778316380519","265383410478499025052396815364601622216","13374543538955399779528030046225904463","133647884505012148475758144537782325970","143991354290431808471122957055852694493","48295507816989569593585476258884554389","166302137040816925980360925645938028941","273701896656080210334384332078304728446","250171595542248573240968275964039381792","297907069727834891065984497309467277730"],"threshold":0.9},"id":"CVE-2025-49586-5cda7ff1","signature_type":"Line"},{"deprecated":false,"digest":{"function_hash":"88502491533919853640029979014038684774","length":489},"id":"CVE-2025-49586-68799c33","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/ef978315649cf83eae396021bb33603a1a5f7e42","target":{"function":"displayCustomWithAuthor","file":"xwiki-platform-core/xwiki-platform-oldcore/src/test/java/com/xpn/xwiki/objects/classes/PropertyClassTest.java"}},{"target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/test/java/com/xpn/xwiki/objects/classes/PropertyClassTest.java","function":"before"},"deprecated":false,"digest":{"function_hash":"320062232082025276346068413185055705671","length":648},"id":"CVE-2025-49586-76cd3fe9","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/ef978315649cf83eae396021bb33603a1a5f7e42"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/ef978315649cf83eae396021bb33603a1a5f7e42","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/objects/classes/PropertyClass.java","function":"displayCustom"},"deprecated":false,"digest":{"function_hash":"37697156820792496635098212090889430059","length":2143},"id":"CVE-2025-49586-f28beb34"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}]}