CVE-2025-51991 Code injection in n/a
Authenticated administrators can inject Velocity code in XWiki preferences, potentially leading to remote code execution or data leakage.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-51991?
CVE-2025-51991 is a high-severity code injection vulnerability in Xwiki Xwiki, published on 20 Aug 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
XWiki through version 17.3.0 is vulnerable to Server-Side Template Injection (SSTI) in the Administration interface, specifically within the HTTP Meta Info field of the Global Preferences Presentation section. An authenticated administrator can inject crafted Apache Velocity template code, which is rendered on the server side without proper validation or sandboxing. This enables the execution of arbitrary template logic, which may expose internal server information or, in specific configurations, lead to further exploitation such as remote code execution or sensitive data leakage. The vulnerability resides in improper handling of dynamic template rendering within user-supplied configuration fields.
Which versions are affected by CVE-2025-51991?
It affects 1 product.
Products include Xwiki Xwiki.
How do I fix CVE-2025-51991?
No fix has been published for CVE-2025-51991 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2025-51991 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-51991 exists.
Public exploit code: 1 Nuclei template.
Other vulnerabilities in Xwiki Xwiki
- CVE-2025-24893 XWiki Platform Eval Injection
- CVE-2025-53836 XWiki Rendering is vulnerable to RCE attacks when processing nested macros
- CVE-2024-55662 XWiki allows remote code execution through the extension sheet
- CVE-2024-55877 XWiki allows remote code execution from account through macro descriptions and XWiki.XWikiSyntaxMacrosList
- CVE-2024-37901 XWiki Platform vulnerable to remote code execution from account via SearchSuggestConfigSheet
Sources
Also known as GHSA-94x5-j7vw-fqv4.