{"id":"CVE-2025-58049","summary":"XWiki PDF export jobs store sensitive cookies unencrypted in job statuses","details":"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions from 14.4.2 to before 16.4.8, 16.5.0-rc-1 to before 16.10.7, and 17.0.0-rc-1 to before 17.4.0-rc-1, the PDF export jobs store sensitive cookies unencrypted in job statuses. XWiki shouldn't store passwords in plain text, and it shouldn't be possible to gain access to plain text passwords by gaining access to, e.g., a backup of the data directory. This vulnerability has been patched in XWiki 16.4.8, 16.10.7, and 17.4.0-rc-1.","aliases":["GHSA-9m7c-m33f-3429"],"modified":"2026-08-12T15:16:52.240726Z","published":"2025-08-28T17:43:39.779Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-212","CWE-257"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/58xxx/CVE-2025-58049.json"},"references":[{"type":"WEB","url":"https://jira.xwiki.org/browse/XWIKI-23151"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/58xxx/CVE-2025-58049.json"},{"type":"ADVISORY","url":"https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-9m7c-m33f-3429"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-58049"},{"type":"FIX","url":"https://github.com/xwiki/xwiki-platform/commit/60982ad0057b1701ed8297f28cad35d170686539"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/xwiki/xwiki-commons","events":[{"introduced":"1626dc5a57e7bced8ee3864d9f47703f62f6e146"},{"fixed":"526362a677ebed92908b74a5dd4abc847ae3713c"},{"introduced":"526fcc68b3f75862a2af7395b5a6dfdd3d2166a5"},{"fixed":"57d47c61d5524d9c61eb26e7b709fd15629695d8"},{"introduced":"e84d9bd1b4c0c8219597e10acfd8fbd692416294"},{"last_affected":"77262561546ae119163fbd5ffc09149e27a8e41d"}],"database_specific":{"cpe":"cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"14.4.2"},{"fixed":"16.4.8"},{"introduced":"16.5.0"},{"fixed":"16.10.7"},{"introduced":"17.0.0"},{"last_affected":"17.3.0"}],"source":"CPE_RANGE"}},{"type":"GIT","repo":"https://github.com/xwiki/xwiki-platform","events":[{"introduced":"cc3304eb18e40b836f37b9ee12ffa15c9f99285a"},{"fixed":"4010087c403dad3fa5adc0231c5640a9c3b92133"},{"introduced":"177e524c2e218fe5de776619271b7cd12c929488"},{"fixed":"a839534ee4037fe44e8e34603d4808a9c617051c"},{"introduced":"7edb5b7d98170ec081c7e30237971d7dfb8a4401"},{"fixed":"60982ad0057b1701ed8297f28cad35d170686539"}],"database_specific":{"cpe":"cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"14.4.2"},{"fixed":"16.4.8"},{"introduced":"16.5.0"},{"fixed":"16.10.7"},{"introduced":"17.0.0"},{"last_affected":"17.3.0"}],"source":["CPE_RANGE","REFERENCES"]}}],"database_specific":{"vanir_signatures":[{"signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/60982ad0057b1701ed8297f28cad35d170686539","target":{"file":"xwiki-platform-core/xwiki-platform-export/xwiki-platform-export-pdf/xwiki-platform-export-pdf-api/src/main/java/org/xwiki/export/pdf/internal/job/PDFExportJob.java"},"deprecated":false,"digest":{"line_hashes":["27038215384853125774305146357683697376","282541914050758194804798514528655106909","256366456117286338771686833179794615700","11237362536277996524064041804708408713"],"threshold":0.9},"id":"CVE-2025-58049-08caf263"},{"id":"CVE-2025-58049-40ff6f29","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/60982ad0057b1701ed8297f28cad35d170686539","target":{"file":"xwiki-platform-core/xwiki-platform-export/xwiki-platform-export-pdf/xwiki-platform-export-pdf-api/src/test/java/org/xwiki/export/pdf/internal/job/PDFExportJobTest.java","function":"runServerSide"},"deprecated":false,"digest":{"function_hash":"68456242542270121254884530537290529834","length":868}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/60982ad0057b1701ed8297f28cad35d170686539","target":{"file":"xwiki-platform-core/xwiki-platform-export/xwiki-platform-export-pdf/xwiki-platform-export-pdf-api/src/test/java/org/xwiki/export/pdf/internal/job/PDFExportJobTest.java"},"deprecated":false,"digest":{"line_hashes":["121477264799734553391782993551270880338","136936159308366953117519894311778078470","300419876184748537125311419291059215016","201348313127527640202544784276528248446","267968795598371104385718495974985093679","232981899797868068274174068821663766950","69468523550605876718570820081791277944","225166692969072949805600904604676103194","95257008464735878418951039558294535679","103747045285809077124256235456184349099","91839896714640808218142617924517398002","120748487708504079951670118317217134790","273947740170381065378333805843109430797","290190376409197258519277356909595846384","297746654142955873246120578080395591734","66872778156841434518801906468994164549","76701076625667041469482016166869458549","178360582981444937828955710223190943778","12930738913361674113504210809381265197","328046542061493489993730580117447852511","192739470676790134089466039303616600833","141618420359287499735099825449887159318","47728971969053398896318737163643307447","89861942567482540638719913100054754479","166638892513099796748060316463346991992","325723687925413615486912248672824327512","236342295000863975931168768887911646188","317941518612653741823299781139263956951","229715971646073236736069030803465823374","1397271267605549225739602967055765475","328857362863195088599513962336431857898","121724081011530403104240357274626720945","7211345320715081923952298686544607470"],"threshold":0.9},"id":"CVE-2025-58049-51497c70"},{"deprecated":false,"digest":{"function_hash":"312597357175905605646217154168203692129","length":688},"id":"CVE-2025-58049-68f95f97","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/60982ad0057b1701ed8297f28cad35d170686539","target":{"file":"xwiki-platform-core/xwiki-platform-export/xwiki-platform-export-pdf/xwiki-platform-export-pdf-api/src/test/java/org/xwiki/export/pdf/internal/job/PDFExportJobTest.java","function":"runWithContentSizeLimitExceeded"}},{"signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/60982ad0057b1701ed8297f28cad35d170686539","target":{"file":"xwiki-platform-core/xwiki-platform-export/xwiki-platform-export-pdf/xwiki-platform-export-pdf-api/src/test/java/org/xwiki/export/pdf/internal/job/PDFExportJobTest.java","function":"runWithoutDocuments"},"deprecated":false,"digest":{"function_hash":"93931751007594583305740643179486684949","length":357},"id":"CVE-2025-58049-6e684ab0","signature_type":"Function"},{"digest":{"function_hash":"52948792202017764716424506932541421846","length":542},"id":"CVE-2025-58049-bdc6def4","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/60982ad0057b1701ed8297f28cad35d170686539","target":{"file":"xwiki-platform-core/xwiki-platform-export/xwiki-platform-export-pdf/xwiki-platform-export-pdf-api/src/test/java/org/xwiki/export/pdf/internal/job/PDFExportJobTest.java","function":"runClientSide"},"deprecated":false}],"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-58049.json","vanir_signatures_modified":"2026-08-12T15:16:52Z"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N"}]}