Read the docs
TI-2022-08708 Aliases CVE-2022-24898GHSA-m2r5-4w96-qxg5

Arbitrary file access through XML parsing in org.xwiki.commons:xwiki-commons-xml

Priority MEDIUM 56CWE-611Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-611 and the CVSS impact.

Summary

org.xwiki.commons:xwiki-commons-xml is a common module used by other XWiki top level projects. Starting in version 2.7 and prior to versions 12.10.10, 13.4.4, and 13.8-rc-1, it is possible for a script to access any file accessing to the user running XWiki application server with XML External Entity Injection through the XML script service. The problem has been patched in versions 12.10.10, 13.4.4, and 13.8-rc-1. There is no easy workaround for fixing this vulnerability other than upgrading and being careful when giving Script rights.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.01485 74th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed xwiki-commons (xwiki): 12.10.10, 13.4.4org.xwiki.commons:xwiki-commons-xml (Maven): 12.10.10, 13.4.4, 13.8-rc-1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
XWikixwiki-commons2.7 to before 12.10.10; 13.0 to before 13.4.4; 13.5-rc-1 – 13.712.10.10, 13.4.4Patch availableCNA
—org.xwiki.commons:xwiki-commons-xml (Maven)2.7 to before 12.10.1012.10.10Patch availableGHSA-m2r5-4w96-qxg5
—org.xwiki.commons:xwiki-commons-xml (Maven)13.0.0 to before 13.4.413.4.4Patch availableGHSA-m2r5-4w96-qxg5
—org.xwiki.commons:xwiki-commons-xml (Maven)13.5-rc-1 to before 13.8-rc-113.8-rc-1Patch availableGHSA-m2r5-4w96-qxg5
  • xwiki-commons VendorXWiki Affected 2.7 to before 12.10.10; 13.0 to before 13.4.4; 13.5-rc-1 – 13.7 Fixed in 12.10.10, 13.4.4 Patch available CNA
  • org.xwiki.commons:xwiki-commons-xml (Maven) Vendor— Affected 2.7 to before 12.10.10 Fixed in 12.10.10 Patch available GHSA-m2r5-4w96-qxg5
  • org.xwiki.commons:xwiki-commons-xml (Maven) Vendor— Affected 13.0.0 to before 13.4.4 Fixed in 13.4.4 Patch available GHSA-m2r5-4w96-qxg5
  • org.xwiki.commons:xwiki-commons-xml (Maven) Vendor— Affected 13.5-rc-1 to before 13.8-rc-1 Fixed in 13.8-rc-1 Patch available GHSA-m2r5-4w96-qxg5

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:xwiki:commons:*:*:*:*:*:*:*:*2.7 to before 12.10.10; 13.0 to before 13.4.4; 13.5 to before 13.8VulnerableXWiki
  • cpe:2.3:a:xwiki:commons:*:*:*:*:*:*:*:* Versions 2.7 to before 12.10.10; 13.0 to before 13.4.4; 13.5 to before 13.8 Vulnerable ·XWiki

Remediation

  • Fix · CNA xwiki-commons (xwiki) Fixed in 12.10.10, 13.4.4
  • Fix · GHSA-m2r5-4w96-qxg5 org.xwiki.commons:xwiki-commons-xml (Maven) Fixed in 12.10.10 Advisory →
  • Fix · GHSA-m2r5-4w96-qxg5 org.xwiki.commons:xwiki-commons-xml (Maven) Fixed in 13.4.4 Advisory →
  • Fix · GHSA-m2r5-4w96-qxg5 org.xwiki.commons:xwiki-commons-xml (Maven) Fixed in 13.8-rc-1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-24898
  2. 2026-10-03 Alias added: GHSA-m2r5-4w96-qxg5

References

Exploit 1

Patch 1

Advisory 2

Other 1

  • TI-2023-18312 HTML sanitizer allows form elements in restricted in org.xwiki.commons:xwiki-commons-xml CVSS 3.1CRITICAL 9.1
  • TI-2023-11288 XWiki Commons may allow privilege escalation to programming rights via user's first name CVSS 3.1CRITICAL 10.0
  • TI-2023-13896 Cross-site Scripting in org.xwiki.commons:xwiki-commons-xml CVSS 3.1CRITICAL 9.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences