8.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-49581

CVE-2025-49581: XWiki allows remote code execution through default value of wiki macro wiki-type parameters

Impact

Any user with edit right on a page (could be the user's profile) can execute code (Groovy, Python, Velocity) with programming right by defining a wiki macro. This allows full access to the whole XWiki installation and thus impacts its confidentiality, integrity and availability. The main problem is that if a wiki macro parameter allows wiki syntax, its default value is executed with the rights of the author of the document where it is used. This can be exploited by overriding a macro like the children macro that is used in a page that has programming right like the page XWiki.ChildrenMacro and thus allows arbitrary script macros. The full reproduction steps can be found in the original issue.

Patches

This vulnerability has been patched in XWiki 16.4.7, 16.10.3 and 17.0.0 by executing wiki parameters with the rights of the wiki macro's author when the parameter's value is the default value.

Workarounds

We're not aware of any workarounds except for upgrading.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-49581

CVE-2025-49581:

8.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
org.xwiki.platform:xwiki-platform-rendering-wikimacro-store	maven	>= 11.10.11, < 12.0
org.xwiki.platform:xwiki-platform-rendering-wikimacro-store	maven	>= 12.6.3, < 12.7
org.xwiki.platform:xwiki-platform-rendering-wikimacro-store	maven	>= 12.8-rc-1, < 16.4.7	16.4.7
org.xwiki.platform:xwiki-platform-rendering-wikimacro-store	maven	>= 16.5.0-rc-1, < 16.10.3	16.10.3
org.xwiki.platform:xwiki-platform-rendering-wikimacro-store	maven	>= 17.0.0-rc-1, < 17.0.0	17.0.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability allowed remote code execution because XWiki improperly handled the execution context for default values of wiki macro parameters that accept wiki syntax. The core issue was that these default values were parsed and executed with the permissions of the author of the document where the macro was used, rather than the more restricted permissions of the macro's author.

The org.xwiki.rendering.wikimacro.internal.DefaultWikiMacroRenderer.parseParameterValue function was primarily responsible. Before the patch, it would take the default value of a wiki-type parameter and pass it to the parseWiki function without differentiating it from user-supplied values in terms of execution context.

The org.xwiki.rendering.wikimacro.internal.DefaultWikiMacroRenderer.parseWiki function (in its pre-patch form) would then invoke this.contentParser.parse using this.syncContext. This syncContext reflected the rights of the current page's author. Consequently, any script (Groovy, Python, Velocity) embedded in the default parameter value would execute with these rights. If an attacker could define a macro (or override an existing one like children) with a malicious script in a default parameter, and that macro was used on a page with programming rights (e.g., XWiki.ChildrenMacro), the script would execute with those elevated programming rights, leading to full access to the XWiki installation.

The patch rectifies this by modifying parseParameterValue to explicitly check if the content being parsed is the parameter's default value. If it is, parseWiki is now called with additional parameters (this.wikimacro.getSourceSyntax() and transform = true) that ensure the default value is parsed and executed within the context and with the rights of the macro's author. The parseWiki function signature was updated to accept these new parameters. Additionally, a new WikiMacroParameterObjectRequiredRightAnalyzer was introduced to enhance security by analyzing the required rights for wiki macro parameter objects, specifically checking their default values if they are of wiki type.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.