XWiki Vulnerability in Notification Email Renderer Class

CVE-2025-49583

What is CVE-2025-49583?

A vulnerability in the XWiki platform allows users without script rights to create documents containing an 'XWiki.Notifications.Code.NotificationEmailRendererClass' object. When an administrator later edits and saves this document, the email templates embedded within the object can be exploited to send unsolicited emails, potentially containing phishing links. Although no malicious code can be executed due to existing safeguards that alert admins before editing Velocity code, the risk remains that unsuspecting users could receive unsolicited communications. This issue was addressed in versions 16.10.2, 16.4.7, and 15.10.16, which introduced enhanced analysis of XClass properties.

References