XWiki allows remote code execution through the extension sheet
Impact
On instances where Extension Repository Application is installed, any user can execute any code requiring programming rights on the server.
In order to reproduce on an instance, as a normal user without script nor programming rights, go to your profile and add an object of type ExtensionCode.ExtensionClass. Set the description to {{async}}{{groovy}}println("Hello from Description"){{/groovy}}{{/async}} and press Save and View. If the description displays as Hello from Description without any error, then the instance is vulnerable.
Patches
This vulnerability has been fixed in XWiki 15.10.9 and 16.3.0.
Workarounds
Since Extension Repository Application is not mandatory, it can be safely disabled on instances that do not use it.
It is also possible to manually apply this patch to the page ExtensionCode.ExtensionSheet, as well as this patch to the page ExtensionCode.ExtensionAuthorsDisplayer.
References
- https://jira.xwiki.org/browse/XWIKI-21890
- https://github.com/xwiki/xwiki-platform/commit/8659f17d500522bf33595e402391592a35a162e8
For more information
If you have any questions or comments about this advisory:
- Open an issue in Jira XWiki.org
- Email us at Security Mailing List
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Java / Kotlin (Maven) | org.xwiki.platform:xwiki-platform-repository-server-ui | >= 3.3-milestone-1, < 15.10.9, >= 16.0.0-rc-1, < 16.3.0 | 15.10.9, 16.3.0 |
References
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H- Weakness (CWE)
CWE-863, CWE-94, CWE-96- Platform
- Java / Kotlin (Maven)
- Package
org.xwiki.platform:xwiki-platform-repository-server-ui- Disclosed
- 12.12.2024
- Updated
- 11.10.2026 12:21
Sources and licenses
OSV / GitHub Advisory Database - GHSA-j2pq-22jj-4pm5 - CC BY 4.0
Vulnerability history: org.xwiki.platform:xwiki-platform-repository-server-ui
All published vulnerabilities of this package (Java / Kotlin (Maven)), newest first. Shows whether this is a one-off slip or a package that needs watching.
This is the only known vulnerability of this package.
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.