TI-2021-19647 Aliases CVE-2021-43841 GHSA-9jq9-c2cv-pcrj

XSS by SVG upload in xwiki-platform

MEDIUM 58CWE-79Published 2022-02-04 · Updated 2025-04-22

Key facts

Attack vector: Network
Privileges required: Low
User interaction: Required
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: Low · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

XWiki is a generic wiki platform offering runtime services for applications built on top of it. When using default XWiki configuration, it's possible for an attacker to upload an SVG containing a script executed when executing the download action on the file. This problem has been patched so that the default configuration doesn't allow to display the SVG files in the browser. Users are advised to update or to disallow uploads of SVG files.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.0087 59th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed xwiki-platform (xwiki): 12.10.6, 13.3RC1org.xwiki.platform:xwiki-platform-oldcore (Maven): 12.10.6, 13.3RC1+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
XWiki	xwiki-platform	before 12.10.6; 13.0 to before 13.3RC1	12.10.6, 13.3RC1	Patch available	CNA
—	org.xwiki.platform:xwiki-platform-oldcore (Maven)	before 12.10.6	12.10.6	Patch available	GHSA-9jq9-c2cv-pcrj
—	org.xwiki.platform:xwiki-platform-oldcore (Maven)	13.0 to before 13.3RC1	13.3RC1	Patch available	GHSA-9jq9-c2cv-pcrj
—	org.xwiki.platform:xwiki-platform-tool-configuration-resources (Maven)	13.0 to before 13.3RC1	13.3RC1	Patch available	GHSA-9jq9-c2cv-pcrj
—	org.xwiki.platform:xwiki-platform-tool-configuration-resources (Maven)	before 12.10.6	12.10.6	Patch available	GHSA-9jq9-c2cv-pcrj

xwiki-platform VendorXWiki Affected before 12.10.6; 13.0 to before 13.3RC1 Fixed in 12.10.6, 13.3RC1 Patch available CNA
org.xwiki.platform:xwiki-platform-oldcore (Maven) Vendor— Affected before 12.10.6 Fixed in 12.10.6 Patch available GHSA-9jq9-c2cv-pcrj
org.xwiki.platform:xwiki-platform-oldcore (Maven) Vendor— Affected 13.0 to before 13.3RC1 Fixed in 13.3RC1 Patch available GHSA-9jq9-c2cv-pcrj
org.xwiki.platform:xwiki-platform-tool-configuration-resources (Maven) Vendor— Affected 13.0 to before 13.3RC1 Fixed in 13.3RC1 Patch available GHSA-9jq9-c2cv-pcrj
org.xwiki.platform:xwiki-platform-tool-configuration-resources (Maven) Vendor— Affected before 12.10.6 Fixed in 12.10.6 Patch available GHSA-9jq9-c2cv-pcrj

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:xwiki:xwiki::::::::	1.0 to before 12.10.6; 13.0 – 13.2	Vulnerable	XWiki

cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:* Versions 1.0 to before 12.10.6; 13.0 – 13.2 Vulnerable ·XWiki

Remediation

Fix · CNA xwiki-platform (xwiki) Fixed in 12.10.6, 13.3RC1
Fix · GHSA-9jq9-c2cv-pcrj org.xwiki.platform:xwiki-platform-oldcore (Maven) Fixed in 12.10.6 Advisory →
Fix · GHSA-9jq9-c2cv-pcrj org.xwiki.platform:xwiki-platform-oldcore (Maven) Fixed in 13.3RC1 Advisory →
Fix · GHSA-9jq9-c2cv-pcrj org.xwiki.platform:xwiki-platform-tool-configuration-resources (Maven) Fixed in 13.3RC1 Advisory →
Fix · GHSA-9jq9-c2cv-pcrj org.xwiki.platform:xwiki-platform-tool-configuration-resources (Maven) Fixed in 12.10.6 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2021-43841
2026-10-03 Alias added: GHSA-9jq9-c2cv-pcrj

References

Exploit 1

https://jira.xwiki.org/browse/XWIKI-18368

Patch 1

https://github.com/xwiki/xwiki-platform/commit/5853d492b3a274db0d94d560e2a5ea988a271c62

Advisory 3

Other 1

https://github.com/xwiki/xwiki-platform

TI-2025-18595 Remote code execution as guest via SolrSearchMacros request in xwiki KEVCVSS 3.1CRITICAL 9.8
TI-2023-25214 Remote code execution through the section parameter in Administration as guest in XWiki Platform CVSS 3.1CRITICAL 10.0
TI-2025-23500 XWiki Platform vulnerable to SQL injection through getdeleteddocuments.vm template sort parameter CVSS 4.0CRITICAL 9.3
TI-2025-23979 org.xwiki.platform:xwiki-platform-rest-server allows SQL injection in query endpoint of REST API CVSS 4.0CRITICAL 9.3
TI-2024-20829 XWiki Platform: Remote code execution from account via SearchSuggestSourceSheet CVSS 3.1CRITICAL 10.0
TI-2024-14375 XWiki Remote Code Execution vulnerability via user registration CVSS 3.1CRITICAL 10.0

See all 247 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences