CVE-2025-58049

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions from 14.4.2 to before 16.4.8, 16.5.0-rc-1 to before 16.10.7, and 17.0.0-rc-1 to before 17.4.0-rc-1, the PDF export jobs store sensitive cookies unencrypted in job statuses. XWiki shouldn't store passwords in plain text, and it shouldn't be possible to gain access to plain text passwords by gaining access to, e.g., a backup of the data directory. This vulnerability has been patched in XWiki 16.4.8, 16.10.7, and 17.4.0-rc-1.

• CWE-212
• CWE-257

• https://github.com/xwiki/xwiki-platform/commit/60982ad0057b1701ed8297f28cad35d170686539Patch
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-9m7c-m33f-3429Vendor Advisory
• https://jira.xwiki.org/browse/XWIKI-23151Exploit, Issue Tracking, Vendor Advisory

Published

Aug 28, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-58043Rejected reason: Not used
• CVE-2025-58044JumpServer is an open source bastion host and an operation a…6.1
• CVE-2025-58045Dataease is an open source data analytics and visualization …9.8
• CVE-2025-58046Dataease is an open-source data visualization and analysis p…9.8
• CVE-2025-58047Volto is a React based frontend for the Plone Content Manage…7.5
• CVE-2025-58048Paymenter is a free and open-source webshop solution for hos…9.9
• CVE-2025-5805Missing Authorization vulnerability in Ninetheme Electron el…6.5
• CVE-2025-58050The PCRE2 library is a set of C functions that implement reg…9.1
• CVE-2025-58051Nextcloud Tables allows you to create your own tables with i…6.5
• CVE-2025-58052Galette is a membership management web application for non p…8.1
• CVE-2025-58053Galette is a membership management web application for non p…9.8
• CVE-2025-58054Discourse is an open-source community discussion platform. V…5.4