CVE-2025-49580 | Teknoloji dünyasından en güncel haberleri ve güvenlikle ilgili gelişmeleri takip edin.

XWiki is a generic wiki platform. From 8.2 and 7.4.5 until 17.1.0-rc-1, 16.10.4, and 16.4.7, pages can gain script or programming rights when they contain a lin…
High CVSS: 8.5

CVE-2025-49580

XWiki is a generic wiki platform. From 8.2 and 7.4.5 until 17.1.0-rc-1, 16.10.4, and 16.4.7, pages can gain script or programming rights when they contain a link and the target of the link is renamed or moved. This might lead to execution of scripts contained in xobjects that should have never been executed. This vulnerability is fixed in 17.1.0-rc-1, 16.10.4, and 16.4.7.
Vendor
Xwiki
Product
Xwiki
CWE
CWE-266
Yayın Tarihi
2025-06-13 16:15:27
Güncelleme
2025-09-03 17:52:44
Source Identifier
security-advisories@github.com
KEV Date Added
-

Kategoriler

CWE-266 Xwiki HIGH Xwiki 2025

Referanslar

https://github.com/xwiki/xwiki-platform/commit/ab209acd780da69a4c5ff77ff011efd698273cec https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-jm43-hrq7-r7w6 https://jira.xwiki.org/browse/XWIKI-22836