CVE-2025-32974 is a critical (CVSS 9.0) flaw in XWiki's required rights analysis, which warns editors before they grant extra rights. It ignores TextAreas with default content type, so scripts placed there can run after a privileged user edits the page. The fixes are 15.10.8 and 16.2.0.
What's affected
XWiki versions from 15.9-rc-1 to before 15.10.8, and from 16.0.0-rc-1 to before 16.2.0, per the CVE record. It is patched in 15.10.8 and 16.2.0.
Since version 15.9, XWiki warns an editor when saving a page would give content such as a script macro more rights. The record says that analysis does not consider certain properties, in particular TextAreas with the default content type. A user can put malicious script in such a property.
The script then runs after a user with script, admin or programming rights edits the page. The record says the effect could reach the confidentiality, integrity and availability of the whole XWiki installation.
How to check if you're exposed
Check the version in the XWiki About or Administration page and compare it with the fixed versions for your release line.
If your wiki is on 15.9 up to 15.10.7, or 16.0 up to 16.1, it is affected. Wikis on 15.10.8 or later in the 15 line, and 16.2.0 or later in the 16 line, include the fix.
Also review which users can edit pages that privileged users commonly open, since the attack relies on a privileged user editing.
What to do now
- Upgrade to 15.10.8, 16.2.0 or later.
- Until the upgrade, privileged users should be careful when editing pages created or changed by users without script rights.
- Limit page creation and edit rights on wikis that matter.
- Review pages for objects with large TextArea properties authored by low trust users.
- Audit who holds script, admin and programming rights, and remove what is not needed.
Why it matters
The record lists CWE-116 (Improper Encoding or Escaping of Output) and CWE-269 (Improper Privilege Management). The warning is meant to stop content written by a low privilege user from silently running with a high privilege user's rights. The analysis skipped some property types, so the safety net had a hole.
Safety nets built from lists of cases tend to fail on the case nobody listed. A more durable design avoids granting the editor's rights to content the editor did not write. See also CVE-2025-32973, a related problem in XWiki's rights handling.
The record does not mark this CVE as CISA KEV and makes no claim of exploitation in the wild.
Quick check
Does an attacker need an account?
The record's vector shows low privileges and user interaction. The attacker needs to place content on a page, and a privileged user has to edit that page.
Sources
- CVE-2025-32974 record on Safeguard Gold
- XWiki advisory GHSA-mvgm-3rw2-7j4r
- XWIKI-22002 on the project tracker
- Fix commit
Last reviewed: 18 October 2026.
