CVE-2025-32970 json
org.xwiki.platform:xwiki-platform-wysiwyg-api Open Redirect vulnerability
published 2025-04-29 18 mo ago modified 2026-06-17 4 mo ago also EUVD-2025-12744 , GHSA-pjhg-9wr9-rj96
- cvss
- 6.1
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.6%
- EPSS 0.6% chance of exploitation in 30 days, percentile 48%
- public exploits
- 0
- none known, plus a Nuclei check
Summary
XWiki is a generic wiki platform. In versions starting from 13.5-rc-1 to before 15.10.13, from 16.0.0-rc-1 to before 16.4.4, and from 16.5.0-rc-1 to before 16.8.0, an open redirect vulnerability in the HTML conversion request filter allows attackers to construct URLs on an XWiki instance that redirects to any URL. This issue has been patched in versions 15.10.13, 16.4.4, and 16.8.0.
Patch / fix
- maven org.xwiki.platform:xwiki-platform-wysiwyg-api 15.10.13, 16.4.4, 16.8.0
- org.xwiki.platform xwiki-platform-wysiwyg-api 15.10.13, 16.4.4, 16.8.0
- xwiki xwiki 15.10.13, 16.4.4, 16.8.0
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- partial
- Assessed
- 18 mo ago
Exploit prediction
0.60% chance of exploitation in the next 30 days, higher than 48% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- Nuclei template XWiki WYSIWYG API - Open Redirect nuclei detection template
- jira.xwiki.org https://jira.xwiki.org/browse/XWIKI-22487 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
| GitHub | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
| NVD | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.xwiki.platform:xwiki-platform-wysiwyg-api | >=13.5-rc-1, <15.10.13 >=16.0.0-rc-1, <16.4.4 >=16.5.0-rc-1, <16.8.0 |
15.10.13 16.4.4 16.8.0 |
Affected products
- xwiki xwiki-platform
Classification
- Weakness
-
- CWE-601 URL Redirection to Untrusted Site
References
-
github.com
/xwiki/xwiki-platform/commit/6dab7909f45deb00efd36a0cd47788e95ad64802
web, patch
-
jira.xwiki.org
/browse/XWIKI-22487
exploit, web, issue-tracking, vendor-advisory
-
github.com
/xwiki/xwiki-platform/security/advisories/GHSA-pjhg-9wr9-rj96
web, vendor-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2025-32970
advisory
-
github.com
/xwiki/xwiki-platform
package
Sources
- CVE List CVE-2025-32970
- GitHub Advisory GHSA-pjhg-9wr9-rj96
- NVD CVE-2025-32970
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.