CVE-2025-32973 is a critical (CVSS 9.0) privilege escalation in XWiki. When a user with programming rights edits a document last edited by someone without them, and it holds an XWiki.ComponentClass object, no warning is shown. The fixes are 15.10.12, 16.4.3 and 16.8.0-rc-1.
What's affected
XWiki versions from 15.9-rc-1 to before 15.10.12, from 16.0.0-rc-1 to before 16.4.3, and from 16.5.0-rc-1 to before 16.8.0-rc-1, per the CVE record. It is patched in 15.10.12, 16.4.3 and 16.8.0-rc-1.
The attack described in the record needs two things. The attacker must have edit rights on at least one page, to place a malicious object there. An administrator, or another user with programming rights, must then edit that document.
Because the second step needs a human, the vector shows user interaction as required and low privileges. The scope is changed, which pushes the score to 9.0.
How to check if you're exposed
Find your XWiki version in the About or Administration pages, and compare it with the three fixed versions for your line.
If you maintain several wikis, list the version for each one and note the release line. Release lines 15.10, 16.4 and 16.8 each have their own fixed version.
As an extra check, ask who has edit rights on public or lightly controlled spaces. The more users who can create pages, the more places a malicious object could sit.
What to do now
- Upgrade to 15.10.12, 16.4.3, 16.8.0-rc-1 or later, in the line that matches your install.
- Until you upgrade, administrators should avoid editing pages last edited by users without programming rights, particularly in spaces open to many authors.
- Limit who can create and edit pages in sensitive wikis.
- Review existing pages for XWiki.ComponentClass objects created by people who should not be adding components.
- Review the list of users with programming rights, and remove it from anyone who does not need it.
Why it matters
The class is CWE-862 (Missing Authorization). The editing flow did not warn that saving the document would give the embedded object the editor's programming rights. The administrator performs an ordinary action and the system quietly widens what unprivileged content can do.
This is a trust boundary problem between authors. In a wiki, content from low trust users is routinely opened by high trust users. Any place where the high trust user's rights carry over to what they open deserves the same scrutiny. XWiki has seen related issues, such as CVE-2025-32974, in the same warning system.
The record does not mark this CVE as CISA KEV and makes no claim of exploitation in the wild.
Quick check
Can an outsider exploit this alone?
No. The record says the attacker needs edit rights on a page and needs an admin or other user with programming rights to edit that document afterwards.
Sources
- CVE-2025-32973 record on Safeguard Gold
- XWiki advisory GHSA-x7wv-5qg4-vmr6
- XWIKI-22460 on the project tracker
- Fix commit
Last reviewed: 18 October 2026.
