CVE-2025-32973

Summary

CVE-2025-32973 is a vulnerability affecting XWiki, a generic wiki platform. In certain versions including 15.9-rc-1 to 15.10.11, 16.0.0-rc-1 to 16.4.2, and 16.5.0-rc-1 to 16.8.0-rc-1, a user with editing rights can gain programming rights on a document last edited by a user without programming rights, if that document contains an XWiki.ComponentClass. This vulnerability can be exploited by an attacker by creating a malicious object and then having an admin user edit the document containing it, thereby granting the attacker programming rights on the wiki. The affected versions have been patched in XWiki 15.10.12, 16.4.3, and 16.8.0-rc-1.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.