CVE-2025-51991: XSS
XWiki through version 17.3.0 is vulnerable to Server-Side Template Injection (SSTI) in the Administration interface, specifically within the HTTP Meta Info field of the Global Preferences Presentation section. An authenticated administrator can inject crafted Apache Velocity template code, which is rendered on the server side without proper validation or sandboxing. This enables the execution of arbitrary template logic, which may expose internal server information or, in specific configurations, lead to further exploitation such as remote code execution or sensitive data leakage. The vulnerability resides in improper handling of dynamic template rendering within user-supplied configuration fields.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-51991?
CVE-2025-51991 is considered a high-severity vulnerability due to the potential for remote code execution through Server-Side Template Injection.
How do I fix CVE-2025-51991?
To fix CVE-2025-51991, upgrade XWiki to a version later than 17.3.0 where the vulnerability has been patched.
Who is affected by CVE-2025-51991?
CVE-2025-51991 affects all XWiki instances up to and including version 17.3.0.
What type of vulnerability is CVE-2025-51991?
CVE-2025-51991 is classified as a Server-Side Template Injection (SSTI) vulnerability.
What could an attacker do with CVE-2025-51991?
An attacker with administrative access can exploit CVE-2025-51991 to execute arbitrary Apache Velocity template code on the server.