Read the docs
TI-2025-36153 Aliases CVE-2025-58365GHSA-gwj6-xpfg-pxwr

XWiki Blog Application: Privilege Escalation (PR) from account through blog content

Priority MEDIUM 46CWE-95Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution, Privilege escalation
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-95 and CWE-250.

Summary

The XWiki blog application allows users of the XWiki platform to create and manage blog posts. Prior to version 9.14, the blog application in XWiki allowed remote code execution for any user who has edit right on any page. Normally, these are all logged-in users as they can edit their own user profile. For an exploit, it is sufficient to add an object of type `Blog.BlogPostClass` to any page and to add some script macro with the exploit code to the "Content" field of that object. The vulnerability has been patched in the blog application version 9.14 by executing the content of blog posts with the rights of the appropriate author. No known workarounds are available.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00584 48th percentileScored 2026-11-07
Fix Fixed application-blog (xwiki-contrib): 9.14org.xwiki.contrib.blog:application-blog-ui (Maven): 9.14

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
XWikiapplication-blogbefore 9.149.14Patch availableCNA
—org.xwiki.contrib.blog:application-blog-ui (Maven)before 9.149.14Patch availableGHSA-gwj6-xpfg-pxwr
  • application-blog VendorXWiki Affected before 9.14 Fixed in 9.14 Patch available CNA
  • org.xwiki.contrib.blog:application-blog-ui (Maven) Vendor— Affected before 9.14 Fixed in 9.14 Patch available GHSA-gwj6-xpfg-pxwr

Remediation

  • Fix · CNA application-blog (xwiki-contrib) Fixed in 9.14
  • Fix · GHSA-gwj6-xpfg-pxwr org.xwiki.contrib.blog:application-blog-ui (Maven) Fixed in 9.14 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-58365
  2. 2026-10-03 Alias added: GHSA-gwj6-xpfg-pxwr

References

Advisory 1

Other 4

  • TI-2025-18595 Remote code execution as guest via SolrSearchMacros request in xwiki KEVCVSS 3.1CRITICAL 9.8
  • TI-2023-25214 Remote code execution through the section parameter in Administration as guest in XWiki Platform CVSS 3.1CRITICAL 10.0
  • TI-2025-23500 XWiki Platform vulnerable to SQL injection through getdeleteddocuments.vm template sort parameter CVSS 4.0CRITICAL 9.3
  • TI-2025-23979 org.xwiki.platform:xwiki-platform-rest-server allows SQL injection in query endpoint of REST API CVSS 4.0CRITICAL 9.3
  • TI-2024-20829 XWiki Platform: Remote code execution from account via SearchSuggestSourceSheet CVSS 3.1CRITICAL 10.0
  • TI-2024-14375 XWiki Remote Code Execution vulnerability via user registration CVSS 3.1CRITICAL 10.0
See all 304 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences