CVE-2025-58049
Medium
Description
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions from 14.4.2 to before 16.4.8, 16.5.0-rc-1 to before 16.10.7, and 17.0.0-rc-1 to before 17.4.0-rc-1, the PDF export jobs store sensitive cookies unencrypted in job statuses. XWiki shouldn't store passwords in plain text, and it shouldn't be possible to gain access to plain text passwords by gaining access to, e.g., a backup of the data directory. This vulnerability has been patched in XWiki 16.4.8, 16.10.7, and 17.4.0-rc-1.
SeverityMedium
CVSS5.8
Exploit probability—
Product
Xwiki
PublishedAug 28, 2025
First seenAug 28, 2025
Weakness typeCWE-212CWE-212CWE-257CWE-257
How to fix
Update
- xwiki xwiki16.4.8, 16.10.7 or later
- org.xwiki.platform:xwiki-platform-export-pdf-api16.4.8, 16.10.7, 17.4.0-rc-1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| xwiki xwiki | 14.4.2 ≤ v < 16.4.8, 16.5.0 ≤ v < 16.10.7, 17.0.0 ≤ v ≤ 17.3.0 | 16.4.8, 16.10.7 |
| org.xwiki.platform:xwiki-platform-export-pdf-apiMaven | 14.4.2 ≤ v < 16.4.8, 16.5.0-rc-1 ≤ v < 16.10.7, 17.0.0-rc-1 ≤ v < 17.4.0-rc-1 | 16.4.8, 16.10.7, 17.4.0-rc-1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.