RCE in Xwiki

CVE-2025-51991

XWiki through version 17.3.0 is vulnerable to Server-Side Template Injection (SSTI) in the Administration interface, specifically within the HTTP Meta Info field of the Global Preferences Presentation section. An authenticated administrator can inject crafted Apache Velocity template code, which is rendered on the server side without proper validation or sandboxing. This enables the execution of arbitrary template logic, which may expose internal server information or, in specific configurations, lead to further exploitation such as remote code execution or sensitive data leakage. The vulnerability resides in improper handling of dynamic template rendering within user-supplied configuration fields.

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.036 (88.3th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Affected products

  • Xwiki
  • N/a — versions n/a

Weakness classification (CWE)

Public proof-of-concept exploits

References

Frequently asked questions

What is CVE-2025-51991?
CVE-2025-51991 is a high-severity vulnerability in Xwiki, classified under Cross-site Scripting. CVSS score: 8.8/10. Published 2025-08-20.
How severe is CVE-2025-51991?
High severity. CVSS v3 base score is 8.8 out of 10.
Is CVE-2025-51991 known to be exploited?
2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.