CVE-2025-58049: XWiki PDF export jobs store sensitive cookies unencrypted in job statuses
5.8
Basic Information
JavaTechnical Details
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.xwiki.platform:xwiki-platform-export-pdf-api | maven | >= 14.4.2, < 16.4.8 | 16.4.8 |
| org.xwiki.platform:xwiki-platform-export-pdf-api | maven | >= 16.5.0-rc-1, < 16.10.7 | 16.10.7 |
| org.xwiki.platform:xwiki-platform-export-pdf-api | maven | >= 17.0.0-rc-1, < 17.4.0-rc-1 | 17.4.0-rc-1 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The analysis of the security advisory and the associated patch commit 60982ad0057b1701ed8297f28cad35d170686539 clearly indicates the source of the vulnerability. The vulnerability description explains that sensitive user cookies are stored in the serialized status of a PDF export job. The patch addresses this by introducing a cleanup() method within the PDFExportJob.java file. This new method is explicitly designed to remove sensitive keys such as request.session, request.headers, and request.cookies from the job's request context. The runInternal() method, which orchestrates the PDF export, was modified to guarantee the execution of this cleanup() method by placing it in a finally block. Therefore, the runInternal() function is identified as the vulnerable function because, before the patch, it was responsible for the process that left sensitive data in a stored state. When a user triggers a PDF export, this function would be on the execution stack, and its failure to sanitize the job context is the root cause of the vulnerability.