XWiki Platform Vulnerability in Custom Display Code and Property Scripts

CVE-2025-49585

What is CVE-2025-49585?

The XWiki Platform is vulnerable due to a flaw that permits the execution of arbitrary code by attackers without script or programming rights. This occurs when such an attacker creates an XClass definition that later enables a victim user, who possesses editing rights and could potentially have admin privileges, to execute malicious code upon editing the document. This vulnerability specifically impacts custom display code and scripts tied to computed properties, posing a significant threat if exploited. Although warnings were added in XWiki version 15.9 to alert users about dangerous properties, prior versions lacked these precautions. The issue was addressed in XWiki versions 15.10.16, 16.4.7, and 16.10.2, which introduced improved checks for XClass properties.

References