CVE-2025-49586
XWiki allows remote code execution through preview of XClass changes in AWM editor
Summary
XWiki allows remote code execution through preview of XClass changes in AWM editor
Original description
The description as published by the source.
XWiki is an open-source wiki software platform. Any XWiki user with edit right on at least one App Within Minutes application (the default for all users XWiki) can obtain programming right/perform remote code execution by editing the application. This vulnerability has been fixed in XWiki 17.0.0, 16.4.7, and 16.10.3.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
References
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- patch github.com
- web jira.xwiki.org