Is org.xwiki.platform:xwiki-platform-notifications-notifiers-default affected by CVE-2025-49583?

Maven org.xwiki.platform:xwiki-platform-notifications-notifiers-default is affected in =16.0.0-rc-1 =16.5.0-rc-1 <16.10.2.

Is CVE-2025-49583 being exploited?

Not on the CISA KEV list. EPSS exploit probability is 0.2%.

medium

CVE-2025-49583

Q: Is CVE-2025-49583 being exploited?

Not on the CISA KEV list. EPSS exploit probability is 0.2%.

Maven · org.xwiki.platform:xwiki-platform-notifications-notifiers-default

Summary

XWiki provides no warning when granting XWiki.Notifications.Code.NotificationEmailRendererClass admin right

Severity: medium
EPSS: 0.2% (p13)
Also known as: GHSA-ff6v-w58f-v97w
Published: 2025-06-13

References

https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-ff6v-w58f-v97w
https://nvd.nist.gov/vuln/detail/CVE-2025-49583
https://github.com/xwiki/xwiki-platform/commit/3d96bf3ceb167bf0213d63f0be1f7e1732eb0a92

Related advisories

CVE-2025-49587 — medium · Maven/org.xwiki.platform:xwiki-platform-notifications-notifiers-default

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Check my repo

Summarize with AI

ChatGPT Claude Perplexity

Sources: CISA KEV (public domain), OSV.dev & GitHub Advisory Database (CC-BY-4.0), FIRST EPSS, NVD/CWE (public domain). Served live from the Stateward advisory database.