GitHub Advisoryadvisory · Maven

GHSA-gwj6-xpfg-pxwr XWiki Blog Application: Privilege Escalation (PR) from account through blog content

HIGH Published 2025-09-08 Modified 2025-09-10 Official page ↗
Aliases
CVE-2025-58365
Ecosystem
Maven
Packages
org.xwiki.contrib.blog:application-blog-ui
Severity
High
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Weaknesses
CWE-250, CWE-94, CWE-95
Reviewed
2025-09-08

Affected packages

• Maven org.xwiki.contrib.blog:application-blog-ui: < 9.14 → fixed in 9.14

Description

Impact The blog application in XWiki allowed remote code execution for any user who has edit right on any page. Normally, these are all logged-in users as they can edit their own user profile. To exploit, it is sufficient to add an object of type `Blog.BlogPostClass` to any page and to add some script macro with the exploit code to the "Content" field of that object. Patches The vulnerability has been patched in the blog application version 9.14 by executing the content of blog posts with the rights of the appropriate author. Workarounds We're not aware of any workarounds. Resources • https://jira.xwiki.org/browse/BLOG-191 • https://github.com/xwiki-contrib/application-blog/commit/b98ab6f17da3029576f42d12b4442cd555c7e0b4

Related

Alias · CVE (1)

  • CVE-2025-58365 The XWiki blog application allows users of the XWiki platform to create and manage blog posts. vulnerability

Weakness · CWE (3)

  • CWE-250 Execution with Unnecessary Privileges weakness
  • CWE-94 Improper Control of Generation of Code weakness
  • CWE-95 Improper Neutralization of Directives in Dynamically Evaluated Code weakness

References