XWiki vulnerabilities
250 CVEs and advisories name XWiki as an affected vendor, 1 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2025-53837org.xwiki.rendering:xwiki-rendering-xml has an Eval Injection issue
- CVE-2026-53966XWiki Platform: Privilege escalation from edit to script right through Live Data editing
- CVE-2026-34151XWiki Platform: Resource path traversal via /skin/ action endpoint in Jetty 12+
- CVE-2026-48048XWiki Platform's Livetable results still allow reconstructing password hashes using 768 requests
- CVE-2026-48047XWiki Platform vulnerable to potential arbitrary file writing using path traversal from (subwiki) admin
- CVE-2026-33137XWiki Platform has an Unauthenticated XAR Import via REST /wikis/{wikiName}
- CVE-2026-23734XWiki Platform: Path traversal via resources parameter in ssx and jsx endpoints when using leading slash
- CVE-2026-40105XWiki has Reflected Cross-Site Scripting (XSS) in its page history compare functionality
- CVE-2026-40104XWiki's REST APIs can list all pages/spaces, leading to unavailability
- CVE-2026-33229XWiki Platform affected by remote code execution with script right through unprotected Velocity scripting API
- CVE-2026-26000XWiki Platform affected by click-jacking through CSS injection in comments
- CVE-2026-24128XWiki Affected by Reflected Cross-Site Scripting (XSS) in Error Messages
- CVE-2025-66474XWiki vulnerable to remote code execution through insufficient protection against {{/html}} injection
- CVE-2025-66473XWiki's REST APIs don't enforce any limits, leading to unavailability and OOM in large wikis
- CVE-2025-66472XWiki vulnerable to a reflected XSS via xredirect parameter in DeleteApplication
- CVE-2025-55749The XWiki Jetty package (XJetty) allows accessing any application file through URL
- CVE-2025-52472XWiki Platform vulnerable to HQL injection via wiki and space search REST API
- CVE-2025-55748XWiki Platform's configuration files can be accessed through jsx and sx endpoints
- CVE-2025-55747XWiki Platform's configuration files can be accessed through the webjars API
- CVE-2025-58049XWiki PDF export jobs store sensitive cookies unencrypted in job statuses
- CVE-2025-54125XWiki Platform: Password and email exposure in xml.vm fields
- CVE-2025-54124XWiki Platform: Any user with editing rights can access password properties through Database List Properties
- CVE-2025-32430XWiki Platform contains Reflected XSS vulnerability in two templates
- CVE-2025-54385XWiki Platform's searchDocuments API allows for SQL injection
- CVE-2025-32429XWiki Platform vulnerable to SQL injection through getdeleteddocuments.vm template sort parameter
- CVE-2025-53836XWiki Rendering is vulnerable to RCE attacks when processing nested macros
- CVE-2025-53835XWiki Rendering is vulnerable to XSS attacks through insecure XHTML syntax
- CVE-2025-49587XWiki does not require right warnings for notification displayer objects
- CVE-2025-49586XWiki allows remote code execution through preview of XClass changes in AWM editor
- CVE-2025-49585XWiki does not require right warnings for XClass definitions