CVE-2025-58365

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2025-58365
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-58365.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2025-58365
Aliases
Published
2025-09-08T21:19:09.381Z
Modified
2025-12-02T20:14:53.305402Z
Severity
  • 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
XWiki Blog Application: Privilege Escalation (PR) from account through blog content
Details

The XWiki blog application allows users of the XWiki platform to create and manage blog posts. Prior to version 9.14, the blog application in XWiki allowed remote code execution for any user who has edit right on any page. Normally, these are all logged-in users as they can edit their own user profile. For an exploit, it is sufficient to add an object of type Blog.BlogPostClass to any page and to add some script macro with the exploit code to the "Content" field of that object. The vulnerability has been patched in the blog application version 9.14 by executing the content of blog posts with the rights of the appropriate author. No known workarounds are available.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/58xxx/CVE-2025-58365.json",
    "cwe_ids": [
        "CWE-95"
    ]
}
References

Affected packages

Git / github.com/xwiki-contrib/application-blog

Affected ranges

Type
GIT
Repo
https://github.com/xwiki-contrib/application-blog
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
83d5f24faf91de3ecb8ad50413cc0d3b4ef4fe28

Affected versions

application-blog-9.*

application-blog-9.10
application-blog-9.10.1
application-blog-9.10.10
application-blog-9.10.2
application-blog-9.10.3
application-blog-9.10.4
application-blog-9.10.5
application-blog-9.10.6
application-blog-9.10.7
application-blog-9.10.8
application-blog-9.10.9
application-blog-9.11
application-blog-9.11.1
application-blog-9.11.2
application-blog-9.11.3
application-blog-9.11.4
application-blog-9.11.5
application-blog-9.11.6
application-blog-9.12
application-blog-9.13
application-blog-9.13.1
application-blog-9.13.10
application-blog-9.13.11
application-blog-9.13.12
application-blog-9.13.2
application-blog-9.13.3
application-blog-9.13.4
application-blog-9.13.5
application-blog-9.13.6
application-blog-9.13.7
application-blog-9.13.8
application-blog-9.13.9
application-blog-9.3
application-blog-9.3.1
application-blog-9.4
application-blog-9.5
application-blog-9.5.1
application-blog-9.6
application-blog-9.7
application-blog-9.7.1
application-blog-9.8
application-blog-9.9
application-blog-9.9.1