CVE-2025-49580: 
Java vulnerability analysis and mitigation

CVE-2025-49580 is a privilege escalation vulnerability in the XWiki platform, classified as "Privilege Escalation through Link Refactoring." It affects the org.xwiki.platform:xwiki-platform-refactoring-default Maven package across versions 7.4.5 through 8.0-milestone-1, 8.2 through 16.4.7, 16.5.0-rc-1 through 16.10.4, and 17.0.0-rc-1 through 17.1.0-rc-1. The vulnerability was published on June 13, 2025, and has a CVSS v4 base score of 8.5 (High) and a CVSS v3.1 base score of 8.0 (High) (Github Advisory, XWiki Security Advisory).

The root cause is an incorrect privilege assignment (CWE-266) in the DefaultReferenceUpdater class within the xwiki-platform-refactoring-default module. When a page containing a link has its link target renamed or moved, the refactoring process incorrectly sets the effectiveMetadataAuthor to the user performing the rename (who may have higher privileges, such as an administrator), rather than preserving the original author for rights computation. This causes the page to inherit the renaming user's script or programming rights, potentially allowing execution of scripts embedded in xobjects that were never intended to run with elevated privileges. The attack requires the attacker to have at least edit rights on a page, and then social-engineer or wait for a higher-privileged user to perform a rename/move operation on a linked page (XWiki Security Advisory, Patch Commit).

Successful exploitation allows a low-privileged attacker (with only edit rights) to escalate to script or programming rights within the XWiki instance, enabling execution of arbitrary scripts embedded in xobjects. This can result in high confidentiality, integrity, and availability impact on the affected XWiki system — including unauthorized data access, data manipulation, and potential disruption of the wiki service. Only the current XWiki system is affected; subsequent/downstream systems are not directly impacted according to the CVSS assessment (Github Advisory, XWiki Security Advisory).

One proof-of-concept reference exists via the XWiki Jira issue tracker (XWIKI-22836), but there is no evidence of active in-the-wild exploitation at this time (Github Advisory). The EPSS score is approximately 0.799% (74th percentile), indicating a moderate predicted probability of exploitation within 30 days. No threat actor attribution or CISA KEV catalog listing has been identified for this vulnerability. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog.

1. Obtain edit rights: Register or use an existing low-privileged account with at least edit rights on the target XWiki instance.
2. Create a page with embedded scripts: Create or edit a page (P2) to include a link to another page (P1) and embed scripts in xobjects (e.g., Velocity macros) that require script or programming rights to execute.
3. Trigger a rename/move by a privileged user: Social-engineer or wait for an administrator or user with higher privileges to rename or move the linked target page (P1). This can be done by making the rename appear routine or necessary.
4. Privilege escalation occurs: When the privileged user performs the rename/move, the DefaultReferenceUpdater incorrectly sets the effectiveMetadataAuthor of P2 to the renaming user (e.g., superadmin), granting P2 the renaming user's script/programming rights.
5. Execute unauthorized scripts: The attacker's xobject scripts on P2 are now executed with elevated privileges, enabling arbitrary code execution, data exfiltration, or further compromise of the XWiki instance (XWiki Security Advisory, Patch Commit).

• Logs: XWiki audit/history logs showing a page's effectiveMetadataAuthor changing to a high-privileged user (e.g., superadmin) after a rename/move operation, while the page's content was last edited by a different, lower-privileged user.
• Logs: Unexpected script or Velocity macro execution events on pages whose content authors do not hold script/programming rights.
• File System / Wiki Content: Pages containing xobjects with embedded scripts (Velocity, Groovy) that were previously inactive but begin executing after a refactoring operation.
• Wiki History: Page revision history entries showing Renamed back-links or Updated the relative links save comments coinciding with a change in the effective metadata author to a privileged account (XWiki Security Advisory).

Upgrade XWiki to one of the patched versions: 16.4.7, 16.10.4, or 17.1.0-rc-1. The fix modifies DefaultReferenceUpdater to only set the originalMetadataAuthor (for display in history) during refactoring operations, ensuring the original author is still used for rights computation. If an immediate upgrade is not possible, the only partial workaround is to restrict refactoring operations (rename/move) to users who have no more than edit rights, preventing privilege escalation via this vector. Alternatively, since the fix is isolated to the xwiki-platform-refactoring-default module, administrators can apply the patch commit and rebuild/redeploy only that module (XWiki Security Advisory, Patch Commit).