{"action":"Upgrade org.xwiki.platform:xwiki-platform-rendering-wikimacro-store to 16.4.7 (16.4.x), 16.10.3 (16.10.x) or 17.0.0 (17.0.x) or later.","affected":[{"introduced":"11.10.11"},{"introduced":"12.6.3"},{"fixed":"16.4.7","introduced":"12.8-rc-1"},{"fixed":"16.10.3","introduced":"16.5.0-rc-1"},{"fixed":"17.0.0","introduced":"17.0.0-rc-1"}],"component":"org.xwiki.platform:xwiki-platform-rendering-wikimacro-store","cve_ids":["CVE-2025-49581"],"ecosystem":"Maven","epss":0.0059,"exploited":false,"fixed_versions":["16.4.7","16.10.3","17.0.0"],"ghsa_id":"GHSA-9875-cw22-f7cx","id":"tcs_01M5N8PGAZJJKN99HDX4GN8MR9","modified_at":"2026-04-01T17:34:16.732469Z","published_at":"2025-06-13T20:40:19Z","references":["https://osv.dev/vulnerability/GHSA-9875-cw22-f7cx","https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-9875-cw22-f7cx","https://nvd.nist.gov/vuln/detail/CVE-2025-49581","https://github.com/xwiki/xwiki-platform/commit/c99d501ed41cbee6a3c02ff927714531570789de","https://github.com/xwiki/xwiki-platform","https://jira.xwiki.org/browse/XWIKI-22760"],"severity":{"label":"high","score":8.8},"sources":[{"source":"osv","source_id":"GHSA-9875-cw22-f7cx","url":"https://osv.dev/vulnerability/GHSA-9875-cw22-f7cx"},{"source":"nvd","source_id":"CVE-2025-49581","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-49581"}],"summary":"XWiki allows remote code execution through default value of wiki macro wiki-type parameters"}