Vulnerabilities

TI-2026-81999 CVE-2026-44179

Syntax injection in XWiki Pro Macros excerpt-include runs code

HIGH 76

XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.0069 Published 2026-10-28 Fixed in 1.14.5 CWE-95

TI-2025-33729 CVE-2025-53837 · GHSA-26vp-8gxg-v4pg

org.xwiki.rendering:xwiki-rendering-xml has an Eval Injection issue

MEDIUM 46

XWiki Rendering is a generic rendering system that converts textual input in a given syntax (wiki syntax, HTML, etc) into another syntax (XHTML, etc).

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.01503 Published 2026-09-18 Fixed in 14.10.2 CWE-95

TI-2026-38933 CVE-2026-53966 · GHSA-45ph-gxxr-gwgw

XWiki Platform: Privilege escalation from edit to script right through Live Data editing

LOW 33

XWiki Platform is a generic wiki platform.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00768 Published 2026-09-15 Fixed in 16.10.17, 17.4.10 +2 CWE-862

TI-2026-26452 CVE-2026-34151 · GHSA-qj4x-9g63-25g6

XWiki Platform: Resource path traversal via /skin/ action endpoint in Jetty 12+

MEDIUM 46

XWiki Platform is a generic wiki platform.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.02469 Published 2026-09-14 Fixed in 17.10.5, 18.2.0 CWE-24

TI-2026-35490 CVE-2026-48048 · GHSA-rh28-mqj4-8x59

XWiki Platform's Livetable results still allow reconstructing password hashes using 768 requests

MEDIUM 43

XWiki Platform is a generic wiki platform.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02008 Published 2026-08-10 Fixed in 16.10.17, 17.4.9 +1 CWE-359

TI-2026-35489 CVE-2026-48047 · GHSA-vgwr-23fq-pr7g

XWiki Platform vulnerable to potential arbitrary file writing using path traversal from (subwiki) admin

MEDIUM 60

XWiki Platform WebJars API is a package for XWiki, a generic wiki platform.

CVSS 4.0MEDIUM 5.9 Network High privileges No interaction EPSS 0.00651 Published 2026-08-07 Fixed in 16.10.17, 17.4.9 +1 CWE-24

TI-2026-25568 CVE-2026-33137 · GHSA-qrvh-r3f2-9h4r

XWiki Platform has an Unauthenticated XAR Import via REST /wikis/{wikiName}

MEDIUM 49

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00594 Published 2026-05-20 Fixed in 16.10.17, 17.4.9 +2 CWE-862

TI-2026-21042 CVE-2026-26028 · GHSA-g2g4-47gv-p72v

CryptPad: Sanitizer Bypass in Diffmarked.js Allows Arbitrary HTML Injection and Potential XSS

LOW 27

CryptPad is an end-to-end encrypted collaborative office suite.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00242 Published 2026-05-20 Fixed in 2026.2.0 CWE-116

TI-2026-19107 CVE-2026-23734 · GHSA-xq3r-2qv5-vqqm

XWiki Platform: Path traversal via resources parameter in ssx and jsx endpoints when using leading slash

MEDIUM 64

XWiki Platform is a generic wiki platform.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.18528 Published 2026-05-20 Fixed in 16.10.17, 17.4.9 +2 CWE-23

TI-2026-30471 CVE-2026-42140 · GHSA-42fc-7w97-8vrc

Server-Side Request Forgery (SSRF) in PlantUML Macro via 'server' parameter

LOW 20

PlantUML Macro is a macro for rendering UML diagrams from simple textual schemes.

CVSS 3.1MEDIUM 4.4 Network Low privileges User interaction EPSS 0.00179 Published 2026-05-04 Fixed in 2.4.1 CWE-918

TI-2025-32422 CVE-2025-51846 · GHSA-jmrh-f3j8-q3c4

CryptPad unbounded WebSocket frame flood

MEDIUM 44

CryptPad 2025.3.1 allows unbounded WebSocket frame flood.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00578 Published 2026-04-30 Fixed in 2026.2.2 CWE-770

TI-2026-28931 CVE-2026-40105 · GHSA-w4fj-87j5-f25c

XWiki has Reflected Cross-Site Scripting (XSS) in its page history compare functionality

LOW 30

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it.

CVSS 4.0MEDIUM 6.5 Network No auth User interaction EPSS 0.00549 Published 2026-04-15 Fixed in 16.10.16, 17.4.8 +1 CWE-80

TI-2026-28930 CVE-2026-40104 · GHSA-mrqg-xmgm-rc5g

XWiki's REST APIs can list all pages/spaces, leading to unavailability

LOW 37

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.004 Published 2026-04-15 Fixed in 16.10.16, 17.4.8 +1 CWE-770

TI-2026-25648 CVE-2026-33229 · GHSA-h259-74h5-4rh9

XWiki Platform affected by remote code execution with script right through unprotected Velocity scripting API

MEDIUM 46

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it.

CVSS 4.0HIGH 8.6 Network High privileges No interaction EPSS 0.0055 Published 2026-04-08 Fixed in 17.4.8, 17.10.1 CWE-862

TI-2025-40550 CVE-2025-66024 · GHSA-h2xq-h7f9-vh6c

XWiki Blog Application home page vulnerable to Stored XSS via Post Title

HIGH 70

The XWiki blog application allows users of the XWiki platform to create and manage blog posts.

CVSS 4.0HIGH 8.6 Network Low privileges User interaction EPSS 0.00439 Published 2026-03-04 Fixed in 9.15.7 CWE-79

TI-2026-21014 CVE-2026-26000 · GHSA-74rh-c5rh-88vg

XWiki Platform affected by click-jacking through CSS injection in comments

LOW 24

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00311 Published 2026-02-12 Fixed in 17.9.0, 17.4.6 +1 CWE-1021

TI-2026-19446 CVE-2026-24128 · GHSA-wvqx-m5px-6cmp

XWiki Affected by Reflected Cross-Site Scripting (XSS) in Error Messages

LOW 30

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it.

CVSS 4.0MEDIUM 6.5 Network No auth User interaction EPSS 0.00551 Published 2026-01-23 Fixed in 16.10.12, 17.4.5 +1 CWE-79

TI-2025-40244 CVE-2025-65091 · GHSA-2g22-wg49-fgv5

XWiki Full Calendar Macro vulnerable to SQL injection through Calendar.JSONService

MEDIUM 49

XWiki Full Calendar Macro displays objects from the wiki on the calendar.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00328 Published 2026-01-10 Fixed in 2.4.5 CWE-89

TI-2025-40243 CVE-2025-65090 · GHSA-637h-ch24-xp9m

XWiki Full Calendar Macro vulnerable to data leak through Calendar.JSONService

LOW 30

XWiki Full Calendar Macro displays objects from the wiki on the calendar.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00281 Published 2026-01-10 Fixed in 2.4.6 CWE-200

TI-2025-40901 CVE-2025-66474 · GHSA-9xc6-c2rm-f27p

XWiki vulnerable to remote code execution through insufficient protection against {{/html}} injection

HIGH 73

XWiki Rendering is a generic rendering system that converts textual input in a given syntax (wiki syntax, HTML, etc) into another syntax (XHTML, etc).

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.01021 Published 2025-12-10 Fixed in 16.10.10, 17.4.3 +1 CWE-95

TI-2025-40900 CVE-2025-66473 · GHSA-cc84-q3v3-mhgf

XWiki's REST APIs don't enforce any limits, leading to unavailability and OOM in large wikis

HIGH 77

XWiki is an open-source wiki software platform.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00403 Published 2025-12-10 Fixed in 16.10.11, 17.4.4 +1 CWE-770

TI-2025-40899 CVE-2025-66472 · GHSA-7vpr-jm38-wr7w

XWiki vulnerable to a reflected XSS via xredirect parameter in DeleteApplication

LOW 35

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it.

CVSS 4.0MEDIUM 6.5 Network No auth User interaction EPSS 0.00507 Published 2025-12-10 Fixed in 16.10.10, 17.4.2 CWE-79

TI-2025-40222 CVE-2025-65036

XWiki Remote Macros vulnerable to remote code execution using the confluence details summary macro

HIGH 69

XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence.

CVSS 3.1HIGH 8.3 Network Low privileges No interaction EPSS 0.00426 Published 2025-12-05 Fixed in 1.27.1 CWE-862

TI-2025-35169 CVE-2025-55749 · GHSA-53gx-j3p6-2rw9

The XWiki Jetty package (XJetty) allows accessing any application file through URL

MEDIUM 47

XWiki is an open-source wiki software platform.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.01577 Published 2025-12-01 Fixed in 16.10.11, 17.4.4 +1 CWE-284

TI-2025-40242 CVE-2025-65089 · GHSA-8c52-x9w7-vc95

XWiki view file macro: User can view content of office file without view rights on the attachment

MEDIUM 63

XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence.

CVSS 3.1MEDIUM 6.8 Network Low privileges User interaction EPSS 0.00296 Published 2025-11-19 Fixed in 1.27.0 CWE-862

Vulnerabilities

Filters