8.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-49586

CVE-2025-49586: XWiki allows remote code execution through preview of XClass changes in AWM editor

Impact

Any XWiki user with edit right on at least one App Within Minutes application (the default for all users XWiki) can obtain programming right/perform remote code execution by editing the application. The detailed reproduction steps can be found in the original bug report.

Patches

This vulnerability has been fixed in XWiki 17.0.0, 16.4.7, and 16.10.3.

Workarounds

Restricting edit rights on all existing App Within Minutes applications to trusted users mitigates at least the PoC exploit, but we can't exclude that there are other ways to exploit this vulnerability.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-49586

CVE-2025-49586:

8.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
org.xwiki.platform:xwiki-platform-oldcore	maven	>= 7.2-milestone-2, < 16.4.7	16.4.7
org.xwiki.platform:xwiki-platform-oldcore	maven	>= 16.5.0-rc-1, < 16.10.3	16.10.3
org.xwiki.platform:xwiki-platform-oldcore	maven	>= 17.0.0-rc-1, < 17.0.0	17.0.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability allows remote code execution through the preview of XClass changes in the App Within Minutes (AWM) editor. This is because the PropertyClass.displayCustom method, which is responsible for rendering the custom display of XClass properties, did not correctly establish the security context for rendering.

The patch ef978315649cf83eae396021bb33603a1a5f7e42 reveals two key changes in com.xpn.xwiki.objects.classes.PropertyClass.displayCustom:

Document Source: The classDocument (representing the XClass definition) was previously fetched using context.getWiki().getDocument(...). This could retrieve a version from the cache or one currently being edited, which might not reflect the authoritative security attributes (like author or restricted status). The fix changes this to getObject().getOwnerDocument(), ensuring the actual, saved document is used.
Restricted Status: The method was modified to explicitly pass the classDocument.isRestricted() status to the renderContentInContext method (by calling a new overload of this method). Previously, this crucial security flag might not have been consistently applied, potentially allowing content that should be restricted to be rendered with higher privileges.

These flaws meant that an attacker with edit rights on an AWM application could craft malicious content for a property's custom display. When this custom display was previewed, the displayCustom method would render it using an incorrect or insufficiently secured context (e.g., wrong author, missing restricted flag). If the custom display content included executable scripts (like Velocity or Groovy, common in XWiki), these scripts could run with elevated permissions, leading to remote code execution.

The displayCustom function is identified as the vulnerable function because it was responsible for these incorrect context-setting steps before initiating the rendering process. The changes in the patch directly address these issues within this function to ensure that custom content is rendered with the correct author context and restriction status derived from the authoritative owner document.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

8.7

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2025-49586: XWiki allows remote code execution through preview of XClass changes in AWM editor

Impact

Patches

Workarounds

CVE-2025-49586:

8.7

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

CVE-2025-49586: XWiki allows remote code execution through preview of XClass changes in AWM editor

Impact

Patches

Workarounds

Basic Information

Basic Information

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

8.7

8.7

Technical Details

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI