CVE-2025-54251

published 2025-09-09

CVE-2025-54251: Adobe Experience Manager versions 6.5.23.0 and earlier are affected by an XML Injection vulnerability that could result in a Security feature bypass. A…

Priority P2 76 medium 4.3 CVSS 3.1

AV N AC L PR L UI N S U C N I L A N

ITW EXPLOIT VulnCheck KEV

Adobe Experience Manager versions 6.5.23.0 and earlier are affected by an XML Injection vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to manipulate XML queries and gain limited unauthorized write access.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
adobe	adobe_experience_manager	<= 6.5.23.0	—
adobe	experience_manager	<= 6.5.23.0	—
adobe	experience_manager	<= 2025.8.0	—
adobe	experience_manager	—	—

Detection & IOCs extracted from sources · hover to see the quote

url /crx/packmgr/service/exec.json;x='x/graphql/execute/json/x'?cmd=upload&jsonInTextarea=true↗

path /crx/packmgr/service/exec.json↗

path META-INF/vault/privileges.xml↗

other ]>&foo;↗

ua hopgoblin/1.0↗

yara↗

rule CVE_2025_54251_AEM_XML_Injection { meta: description = "Detects CVE-2025-54251 Adobe Experience Manager XML Injection exploit attempt" strings: $ua = "hopgoblin/1.0" $path = "/crx/packmgr/service/exec.json" $bypass = "x='x/graphql/execute/json/x'" $xxe = "]>&foo;" condition: $ua and $path and $bypass }

• → Detect POST requests to /crx/packmgr/service/exec.json with the semicolon-based path bypass suffix ;x='x/graphql/execute/json/x' and query parameter cmd=upload, which is the exploitation path for CVE-2025-54251. ↗
• → Flag multipart/form-data uploads to the AEM package manager endpoint that include a ZIP file containing META-INF/vault/privileges.xml with an XXE payload (]>&foo;). ↗
• → Alert on HTTP requests bearing the User-Agent 'hopgoblin/1.0', which is the scanner/exploit tool associated with this CVE. ↗
• → Monitor for out-of-band (OOB/OAST) DNS or HTTP callbacks triggered from the AEM server, as successful exploitation causes the server to make external requests (interactsh_protocol: http). ↗
• → The attack uses semicolon-based path traversal/bypass patterns (;x='.pdf/x', ;x='.ico/x', ;x='.html/x', ;x='.css/x', ;x='x/graphql/execute/json/x') to evade AEM dispatcher/security filters on sensitive endpoints. ↗
• → The exploit targets a low-privileged (authenticated) user context; monitor for unexpected package upload activity (cmd=upload) from non-admin accounts on the AEM package manager. ↗

• · The Nuclei template uses out-of-band interaction (interactsh) to confirm exploitation; detection without an OOB callback infrastructure will only catch the request pattern, not confirmed exploitation. ↗
• · The template is tagged 'intrusive' — the exploit uploads a malicious ZIP package to the AEM package manager, which may cause side effects on production systems during detection scanning. ↗
• · The bypass relies on AEM dispatcher misconfiguration that allows semicolon-suffixed paths to reach protected endpoints; environments with a correctly hardened dispatcher blocking semicolons in URLs may not be exploitable. ↗
• · The template stops at first successful path match (stop-at-first-match: true), so IDS/WAF rules should cover all six bypass path variants to ensure full coverage. ↗

CVSS provenance

nvd v3.1 4.3 MEDIUM CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

vulncheck 4.3 MEDIUM

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-91