Medium severity · published Aug 5, 2025
CVE-2025-32430
XWiki Platform contains Reflected XSS vulnerability in two templates
6.1
CVSS
0.7%
EPSS
No
On KEV
Description
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions 4.2-milestone-3 through 16.4.7, 16.5.0-rc-1 through 16.10.5 and 17.0.0-rc-1 through 17.2.2, two templates contain reflected XSS vulnerabilities, allowing an attacker to execute malicious JavaScript code in the context of the victim's session by getting the victim to visit an attacker-controlled URL. This permits the attacker to perform arbitrary actions using the permissions of the victim. This issue is fixed in versions 16.4.8, 16.10.6 and 17.3.0-rc-1. To workaround the issue, manually patch the WAR with the same changes as the original patch.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 53% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
XW
xwiki-platform · xwiki
>= 4.2-milestone-3, < 16.4.8; >= 16.5.0-rc-1, < 16.10.6; >= 17.0.0-rc-1, < 17.3.0-rc-1 · source: vendor
XW
Xwiki · Xwiki
4.3 before 16.4.8; 16.5.0 before 16.10.6; 17.0.0 through 17.2.2; 4.2; 16.5.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-32430
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-32430
Patch
https://github.com/xwiki/xwiki-platform/commit/e5926a938cbecc8b1eaa48053d8d370cff107cb0
Exploit
https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-m9x4-w7p9-mxhx
Exploit
https://jira.xwiki.org/browse/XWIKI-23096
More from xwiki-platform
9.8
CVE-2025-24893
Remote code execution as guest via SolrSearchMacros request in xwiki
9.8
CVE-2026-33229
XWiki Platform affected by remote code execution with script right through unprotected Velocity scripting API
9.8
CVE-2025-54385
XWiki Platform's searchDocuments API allows for SQL injection
9.8
CVE-2025-32429
XWiki Platform vulnerable to SQL injection through getdeleteddocuments.vm template sort parameter
9.3
CVE-2026-33137
XWiki Platform has an Unauthenticated XAR Import via REST /wikis/{wikiName}