Overview
The vulnerability, CVE-2025-51991, poses a significant security risk to XWiki systems running versions up to 17.3.0. Identified as a Server-Side Template Injection (SSTI) vulnerability, it lies in the Administration interface of XWiki’s Global Preferences Presentation section, more specifically within the HTTP Meta Info field. This vulnerability is significant because it could potentially lead to system compromise and data leakage. XWiki administrators and organizations utilizing XWiki need to be aware of this vulnerability and take the necessary steps to mitigate its potential impact.
Vulnerability Summary
CVE ID: CVE-2025-51991
Severity: High (8.8 CVSS score)
Attack Vector: Network
Privileges Required: High (Administrator)
User Interaction: None
Impact: Potential system compromise and sensitive data leakage
Affected Products
Escape the Surveillance Era
Most apps won’t tell you the truth.
They’re part of the problem.
Phone numbers. Emails. Profiles. Logs.
It’s all fuel for surveillance.
Ameeba Chat gives you a way out.
- • No phone number
- • No email
- • No personal info
- • Anonymous aliases
- • End-to-end encrypted
Chat without a trace.
Product | Affected Versions
XWiki | Up to and including 17.3.0
How the Exploit Works
The vulnerability arises from the improper handling of dynamic template rendering within user-supplied configuration fields. When an authenticated administrator inserts crafted Apache Velocity template code into the HTTP Meta Info field, the server renders it without proper validation or sandboxing. This allows the execution of arbitrary template logic, which can expose internal server information or, in specific configurations, lead to further exploitation such as remote code execution or sensitive data leakage.
Conceptual Example Code
Here is a conceptual example of how the vulnerability might be exploited. This is a hypothetical HTTP POST request to the vulnerable endpoint containing malicious Apache Velocity template code:
POST /admin/globalPreferences HTTP/1.1
Host: target.xwiki.com
Content-Type: application/x-www-form-urlencoded
httpMetaInfo=${some_malicious_template}In this example, “some_malicious_template” represents a crafted Apache Velocity template code that could exploit the SSTI vulnerability. This code would be executed server-side when the HTTP Meta Info field is rendered.
Mitigation Recommendations
Users are advised to apply the vendor patch as soon as possible to mitigate the vulnerability. In case of delay in applying the patch, using a Web Application Firewall (WAF) or an Intrusion Detection System (IDS) can serve as a temporary mitigation measure. Additionally, administrators should avoid entering untrusted data into the HTTP Meta Info field of the Global Preferences Presentation section.