Sign in
Deutsch English Español Polski
Medium

Velocity execution without script right through VelocityCode and VelocityWiki property

  • Disclosed: 04.09.2023
  • Updated: 11.10.2026 13:20

Impact

It is possible in XWiki to execute Velocity code without having script right by creating an XClass with a property of type "TextArea" and content type "VelocityCode" or "VelocityWiki". For the former, the syntax of the document needs to be set the xwiki/1.0 (this syntax doesn't need to be installed). In both cases, when adding the property to an object, the Velocity code is executed regardless of the rights of the author of the property (edit right is still required, though). In both cases, the code is executed with the correct context author so no privileged APIs can be accessed. However, Velocity still grants access to otherwise inaccessible data and APIs that could allow further privilege escalation.

At least for "VelocityCode", this behavior is most likely very old but only since XWiki 7.2, script right is a separate right, before that version all users were allowed to execute Velocity and thus this was expected and not a security issue.

Patches

This has been patched in XWiki 14.10.10 and 15.4 RC1.

Workarounds

There are no known workarounds.

References

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
Java / Kotlin (Maven) org.xwiki.platform:xwiki-platform-oldcore >= 7.2, < 14.10.10, >= 15.0-rc-1, < 15.4-rc-1 14.10.10, 15.4-rc-1

References

CVSS score 6.3/10
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Weakness (CWE)
CWE-862
Platform
Java / Kotlin (Maven)
Package
org.xwiki.platform:xwiki-platform-oldcore
Disclosed
04.09.2023
Updated
11.10.2026 13:20

Sources and licenses

OSV / GitHub Advisory Database - GHSA-m5m2-h6h9-p2c8 - CC BY 4.0

Vulnerability history: org.xwiki.platform:xwiki-platform-oldcore

All published vulnerabilities of this package (Java / Kotlin (Maven)), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (46) in the archive
Total entries
46
First → latest
09.2020 07.2026
Without a fix
0
Exploited in attacks
0

Severity breakdown

  • Critical 12
  • High 17
  • Medium 15
  • Low 2

Disclosures per year

Severity:
  1. XWiki Platform Old Core: Resource path traversal via /skin/ action endpoint in Jetty 12+
    High CVE-2026-34151 < 17.10.5, >= 18.0.0-rc-1, < 18.2.0 17.10.5, 18.2.0
  2. XWiki vulnerable to remote code execution with script right through unprotected Velocity scripting API
    High CVE-2026-33229 >= 17.0.0-rc-1, < 17.4.8, >= 17.5.0-rc-1, < 17.10.1 17.4.8, 17.10.1
  3. XWiki exposes passwords and emails stored in fields not named password/email in xml.vm
    High CVE-2025-54125 >= 1.1, < 16.4.7, >= 16.5.0-rc-1, < 16.10.5, >= 17.0.0-rc-1, < 17.2.0-rc-1 16.4.7, 16.10.5, 17.2.0-rc-1
  4. XWiki leaks password hashes and other accessible password properties
    High CVE-2025-54124 >= 9.8-rc-1, < 16.4.7, >= 16.5.0-rc-1, < 16.10.5, >= 17.0.0-rc-1, < 17.2.0-rc-1 16.4.7, 16.10.5, 17.2.0-rc-1
  5. XWiki Platform vulnerable to SQL injection through XWiki#searchDocuments API
    High CVE-2025-54385 >= 1.0, < 16.10.6, >= 17.0.0-rc1, < 17.3.0-rc-1 16.10.6, 17.3.0-rc-1
  6. XWiki allows remote code execution through preview of XClass changes in AWM editor
    High CVE-2025-49586 >= 7.2-milestone-2, < 16.4.7, >= 16.5.0-rc-1, < 16.10.3, >= 17.0.0-rc-1, < 17.0.0 16.4.7, 16.10.3, 17.0.0
  7. XWiki allows SQL injection in query endpoint of REST API with Oracle
    Critical CVE-2024-56158 >= 1.0, < 15.10.16, >= 16.0.0-rc-1, < 16.4.7, >= 16.5.0-rc-1, < 16.10.2 15.10.16, 16.4.7, 16.10.2
  8. org.xwiki.platform:xwiki-platform-oldcore allows SQL injection in short form select requests through the script query API
    High CVE-2025-32968 >= 1.6-milestone-1, < 15.10.16, >= 16.0.0-rc-1, < 16.4.6, >= 16.5.0-rc-1, < 16.10.1 15.10.16, 16.4.6, 16.10.1
  9. XWiki Platform allows XSS through XClass name in string properties
    Critical · 9.0 CVE-2024-43400 >= 1.1.2, < 14.10.21, >= 15.0-rc-1, < 15.5.5, >= 15.6-rc-1, < 15.10.6, >= 16.0.0-rc-1, < 16.0.0 14.10.21, 15.5.5, 15.10.6, 16.0.0
  10. XWiki Platform allows remote code execution from user account
    Critical · 9.0 CVE-2024-37899 >= 13.4.7, < 14.10.21, >= 13.10.3, < 14.10.21, >= 15.0-rc-1, < 15.5.5, >= 15.6-rc-1, < 15.10.6, >= 16.0.0-rc-1, < 16.0.0 14.10.21, 15.5.5, 15.10.6, 16.0.0
  11. XWiki Platform remote code execution from account via custom skins support
    Critical · 9.9 CVE-2024-31987 >= 6.4-milestone-1, < 14.10.19, >= 15.0-rc-1, < 15.5.4, >= 15.6-rc-1, < 15.10-rc-1 14.10.19, 15.5.4, 15.10-rc-1
  12. XWiki Platform: Privilege escalation (PR) from user registration through PDFClass
    Critical · 9.9 CVE-2024-31981 >= 3.0.1, < 14.10.20, >= 15.0-rc-1, < 15.5.4, >= 15.6-rc-1, < 15.10-rc-1 14.10.20, 15.5.4, 15.10-rc-1
  13. XWiki has no right protection on rollback action
    High · 8.0 CVE-2024-21648 >= 1.0, < 14.10.17 14.10.17
  14. XWiki Platform vulnerable to privilege escalation and remote code execution via the edit action
    High · 8.8 CVE-2023-46243 >= 15.0, < 15.2-rc-1, >= 1.0, < 14.10.6 15.2-rc-1, 14.10.6
  15. XWiki Platform vulnerable to remote code execution via the edit action because it lacks CSRF token
    Critical · 9.6 CVE-2023-46242 >= 1.0, < 14.10.7, >= 15.0, < 15.2-rc-1 14.10.7, 15.2-rc-1
  16. Velocity execution without script right through VelocityCode and VelocityWiki property this entry
    Medium · 6.3 CVE-2023-41046 >= 7.2, < 14.10.10, >= 15.0-rc-1, < 15.4-rc-1 14.10.10, 15.4-rc-1
  17. XWiki Platform vulnerable to CSRF privilege escalation/RCE via the create action
    High · 8.0 CVE-2023-40572 >= 3.2-milestone-3, < 14.10.9, >= 15.0-rc-1, < 15.4-rc-1 14.10.9, 15.4-rc-1
  18. Upgrading doesn't prevent exploiting vulnerable XWiki documents
    Critical · 9.9 CVE-2023-36468 >= 2.0, < 14.10.7, >= 15.0-rc-1, < 15.2-rc-1 14.10.7, 15.2-rc-1
  19. XWiki Platform vulnerable to reflected cross-site scripting via delattachment action
    High · 8.4 CVE-2023-35157 >= 3.2-milestone-3, < 14.10.6, >= 15.0-rc-0, < 15.1-rc-1 14.10.6, 15.1-rc-1
  20. XWiki Platform's async and display macro allow displaying and interacting with any document in restricted mode
    Critical · 9.9 CVE-2023-29526 >= 10.11.1, < 13.10.11, >= 14.0-rc-1, < 14.4.8, >= 14.5, < 14.10.3 13.10.11, 14.4.8, 14.10.3
Show more (10) Showing 20 of 30

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.