Read the docs
TI-2022-08707 Aliases CVE-2022-24897GHSA-cvx5-m8vg-vxgc

Arbitrary filesystem write access from Velocity

Priority HIGH 68CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

APIs to evaluate content with Velocity is a package for APIs to evaluate content with Velocity. Starting with version 2.3 and prior to 12.6.7, 12.10.3, and 13.0, the velocity scripts are not properly sandboxed against using the Java File API to perform read or write operations on the filesystem. Writing an attacking script in Velocity requires the Script rights in XWiki so not all users can use it, and it also requires finding an XWiki API which returns a File. The problem has been patched in versions 12.6.7, 12.10.3, and 13.0. There is no easy workaround for fixing this vulnerability other than upgrading and being careful when giving Script rights.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.0179 78th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed xwiki-commons (xwiki): 12.6.7org.xwiki.commons:xwiki-commons-velocity (Maven): 12.6.7, 12.10.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
XWikixwiki-commons2.3 to before 12.6.7; 12.7-rc-1, < 12.10.312.6.7Patch availableCNA
—org.xwiki.commons:xwiki-commons-velocity (Maven)2.3.0 to before 12.6.712.6.7Patch availableGHSA-cvx5-m8vg-vxgc
—org.xwiki.commons:xwiki-commons-velocity (Maven)12.7.0 to before 12.10.312.10.3Patch availableGHSA-cvx5-m8vg-vxgc
  • xwiki-commons VendorXWiki Affected 2.3 to before 12.6.7; 12.7-rc-1, < 12.10.3 Fixed in 12.6.7 Patch available CNA
  • org.xwiki.commons:xwiki-commons-velocity (Maven) Vendor— Affected 2.3.0 to before 12.6.7 Fixed in 12.6.7 Patch available GHSA-cvx5-m8vg-vxgc
  • org.xwiki.commons:xwiki-commons-velocity (Maven) Vendor— Affected 12.7.0 to before 12.10.3 Fixed in 12.10.3 Patch available GHSA-cvx5-m8vg-vxgc

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*2.3 to before 12.6.7; 12.7 to before 12.10.3VulnerableXWiki
  • cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:* Versions 2.3 to before 12.6.7; 12.7 to before 12.10.3 Vulnerable ·XWiki

Remediation

  • Fix · CNA xwiki-commons (xwiki) Fixed in 12.6.7
  • Fix · GHSA-cvx5-m8vg-vxgc org.xwiki.commons:xwiki-commons-velocity (Maven) Fixed in 12.6.7 Advisory →
  • Fix · GHSA-cvx5-m8vg-vxgc org.xwiki.commons:xwiki-commons-velocity (Maven) Fixed in 12.10.3 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-24897
  2. 2026-10-03 Alias added: GHSA-cvx5-m8vg-vxgc

References

Exploit 1

Patch 2

Advisory 2

Other 1

  • TI-2025-18595 Remote code execution as guest via SolrSearchMacros request in xwiki KEVCVSS 3.1CRITICAL 9.8
  • TI-2023-25214 Remote code execution through the section parameter in Administration as guest in XWiki Platform CVSS 3.1CRITICAL 10.0
  • TI-2025-23500 XWiki Platform vulnerable to SQL injection through getdeleteddocuments.vm template sort parameter CVSS 4.0CRITICAL 9.3
  • TI-2025-23979 org.xwiki.platform:xwiki-platform-rest-server allows SQL injection in query endpoint of REST API CVSS 4.0CRITICAL 9.3
  • TI-2024-20829 XWiki Platform: Remote code execution from account via SearchSuggestSourceSheet CVSS 3.1CRITICAL 10.0
  • TI-2024-14375 XWiki Remote Code Execution vulnerability via user registration CVSS 3.1CRITICAL 10.0
See all 247 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences