Read the docs
TI-2022-20269 Aliases CVE-2022-41928GHSA-9hqh-fmhg-vq2j

XWiki Platform vulnerable to Improper Neutralization of Directives in Dynamically…

Priority HIGH 76CWE-95Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-95.

Summary

XWiki Platform vulnerable to Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in AttachmentSelector.xml. The issue can also be reproduced by inserting the dangerous payload in the `height` or `alt` macro properties. This has been patched in versions 13.10.7, 14.4.2, and 14.5. The issue can be fixed on a running wiki by updating `XWiki.AttachmentSelector` with the versions below: - 14.5-rc-1+: https://github.com/xwiki/xwiki-platform/commit/eb15147adf94bddb92626f862c1710d45bcd64a7#diff-e1513599ab698991f6cbba55d38f3f464432ced8d137a668b1f7618c7e747e23 - 14.4.2+: https://github.com/xwiki/xwiki-platform/commit/c02f8eb1f3c953d124f2c097021536f8bc00fa8d#diff-e1513599ab698991f6cbba55d38f3f464432ced8d137a668b1f7618c7e747e23 - 13.10.7+: https://github.com/xwiki/xwiki-platform/commit/efd0df0468d46149ba68b66660b93f31b6318515#diff-e1513599ab698991f6cbba55d38f3f464432ced8d137a668b1f7618c7e747e23

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.01046 64th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Fixed xwiki-platform (xwiki): 13.10.7, 14.4.2org.xwiki.platform:xwiki-platform-attachment-ui (Maven): 13.10.7, 14.4.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
XWikixwiki-platform5.0-milestone-1 to before 13.10.7; 14.0.0 to before 14.4.213.10.7, 14.4.2Patch availableCNA
—org.xwiki.platform:xwiki-platform-attachment-ui (Maven)5.0-milestone-1 to before 13.10.713.10.7Patch availableGHSA-9hqh-fmhg-vq2j
—org.xwiki.platform:xwiki-platform-attachment-ui (Maven)14.0.0 to before 14.4.214.4.2Patch availableGHSA-9hqh-fmhg-vq2j
  • xwiki-platform VendorXWiki Affected 5.0-milestone-1 to before 13.10.7; 14.0.0 to before 14.4.2 Fixed in 13.10.7, 14.4.2 Patch available CNA
  • org.xwiki.platform:xwiki-platform-attachment-ui (Maven) Vendor— Affected 5.0-milestone-1 to before 13.10.7 Fixed in 13.10.7 Patch available GHSA-9hqh-fmhg-vq2j
  • org.xwiki.platform:xwiki-platform-attachment-ui (Maven) Vendor— Affected 14.0.0 to before 14.4.2 Fixed in 14.4.2 Patch available GHSA-9hqh-fmhg-vq2j

CPE configurations NVD · 5

CPEVersionsRoleVendor
cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*after 5.0, before 13.10.7; 14.0.0 to before 14.4.2VulnerableXWiki
cpe:2.3:a:xwiki:xwiki:5.0:milestone1:*:*:*:*:*:*5.0 milestone1VulnerableXWiki
cpe:2.3:a:xwiki:xwiki:5.0:milestone2:*:*:*:*:*:*5.0 milestone2VulnerableXWiki
cpe:2.3:a:xwiki:xwiki:14.4.3:*:*:*:*:*:*:*14.4.3VulnerableXWiki
cpe:2.3:a:xwiki:xwiki:14.4.4:*:*:*:*:*:*:*14.4.4VulnerableXWiki
  • cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:* Versions after 5.0, before 13.10.7; 14.0.0 to before 14.4.2 Vulnerable ·XWiki
  • cpe:2.3:a:xwiki:xwiki:5.0:milestone1:*:*:*:*:*:* Versions 5.0 milestone1 Vulnerable ·XWiki
  • cpe:2.3:a:xwiki:xwiki:5.0:milestone2:*:*:*:*:*:* Versions 5.0 milestone2 Vulnerable ·XWiki
  • cpe:2.3:a:xwiki:xwiki:14.4.3:*:*:*:*:*:*:* Versions 14.4.3 Vulnerable ·XWiki
  • cpe:2.3:a:xwiki:xwiki:14.4.4:*:*:*:*:*:*:* Versions 14.4.4 Vulnerable ·XWiki

Remediation

  • Fix · CNA xwiki-platform (xwiki) Fixed in 13.10.7, 14.4.2
  • Fix · GHSA-9hqh-fmhg-vq2j org.xwiki.platform:xwiki-platform-attachment-ui (Maven) Fixed in 13.10.7 Advisory →
  • Fix · GHSA-9hqh-fmhg-vq2j org.xwiki.platform:xwiki-platform-attachment-ui (Maven) Fixed in 14.4.2 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-41928
  2. 2026-10-03 Alias added: GHSA-9hqh-fmhg-vq2j

References

Exploit 2

Advisory 1

Other 1

  • TI-2025-18595 Remote code execution as guest via SolrSearchMacros request in xwiki KEVCVSS 3.1CRITICAL 9.8
  • TI-2023-25214 Remote code execution through the section parameter in Administration as guest in XWiki Platform CVSS 3.1CRITICAL 10.0
  • TI-2025-23500 XWiki Platform vulnerable to SQL injection through getdeleteddocuments.vm template sort parameter CVSS 4.0CRITICAL 9.3
  • TI-2025-23979 org.xwiki.platform:xwiki-platform-rest-server allows SQL injection in query endpoint of REST API CVSS 4.0CRITICAL 9.3
  • TI-2024-20829 XWiki Platform: Remote code execution from account via SearchSuggestSourceSheet CVSS 3.1CRITICAL 10.0
  • TI-2024-14375 XWiki Remote Code Execution vulnerability via user registration CVSS 3.1CRITICAL 10.0
See all 247 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences