Sign in
Deutsch English Español Polski
Medium

XWiki vulnerable to a reflected XSS via xredirect parameter in DeleteApplication

  • Disclosed: 10.12.2025
  • Updated: 11.10.2026 12:22

Impact

A reflected XSS vulnerability in XWiki allows an attacker to send a victim to a URL with a deletion confirmation message on which the attacker-supplied script is executed when the victim clicks the "No" button. When the victim has admin or programming right, this allows the attacker to execute basically arbitrary actions on the XWiki installation including remote code execution.

Patches

This vulnerability has been patched in XWiki 16.10.10, 17.4.2 and 17.5.0 by using the affected URL parameter only in the intended context.

Workarounds

The patch can be manually applied to the templates that are present in the WAR. A restart of XWiki is needed for the changes to be applied.

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
Java / Kotlin (Maven) org.xwiki.platform:xwiki-platform-flamingo-skin-resources >= 6.2-milestone-1, < 16.10.10, >= 17.0.0-rc-1, < 17.4.2 16.10.10, 17.4.2
Java / Kotlin (Maven) org.xwiki.platform:xwiki-platform-web-templates >= 6.2-milestone-1, < 16.10.10, >= 17.0.0-rc-1, < 17.4.2 16.10.10, 17.4.2

References

CVSS score -
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H
Weakness (CWE)
CWE-79, CWE-80
Platform
Java / Kotlin (Maven)
Package
org.xwiki.platform:xwiki-platform-flamingo-skin-resources, org.xwiki.platform:xwiki-platform-web-templates
Disclosed
10.12.2025
Updated
11.10.2026 12:22

Sources and licenses

OSV / GitHub Advisory Database - GHSA-7vpr-jm38-wr7w - CC BY 4.0

Vulnerability history: org.xwiki.platform:xwiki-platform-web-templates

All published vulnerabilities of this package (Java / Kotlin (Maven)), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (23) in the archive
Total entries
23
First → latest
02.2022 04.2026
Without a fix
0
Exploited in attacks
0

Severity breakdown

  • Critical 10
  • High 4
  • Medium 8
  • Low 1

Disclosures per year

Severity:
  1. XWiki vulnerable to a reflected XSS via xredirect parameter in DeleteApplication this entry
    Medium CVE-2025-66472 >= 6.2-milestone-1, < 16.10.10, >= 17.0.0-rc-1, < 17.4.2 16.10.10, 17.4.2
  2. In XWiki Platform, payloads stored in content is executed when a user with script/programming right edit them
    Critical · 9.0 CVE-2024-43401 < 15.10-rc-1 15.10-rc-1
  3. XWiki Platform vulnerable to Cross-Site Scripting (XSS) through conflict resolution
    Critical · 9.0 CVE-2024-41947 >= 11.8-rc-1, < 15.10.8, >= 16.0.0-rc-1, < 16.3.0-rc-1 15.10.8, 16.3.0-rc-1
  4. XWiki Platform vulnerable to XSS with edit right in the create document form for existing pages
    Critical · 9.0 CVE-2023-45137 < 14.10.12, >= 15.0-rc-1, < 15.5-rc-1 14.10.12, 15.5-rc-1
  5. XWiki Platform web templates vulnerable to reflected XSS in the create document form if name validation is enabled
    Critical · 9.6 CVE-2023-45136 >= 12.0-rc-1, < 14.10.12, >= 15.0-rc-1, < 15.5-rc-1 14.10.12, 15.5-rc-1
  6. XWiki users can be tricked to execute scripts as the create page action doesn't display the page's title
    Critical · 9.0 CVE-2023-45135 < 14.10.12, >= 15.0-rc-1, < 15.5-rc-1 14.10.12, 15.5-rc-1
  7. XWiki Platform XSS vulnerability from account in the create page form via template provider
    Critical · 9.0 CVE-2023-45134 < 14.10.12, >= 15.0-rc-1, < 15.5-rc-1 14.10.12, 15.5-rc-1
  8. XWiki Platform vulnerable to reflected cross-site scripting via back and xcontinue parameters in resubmit template
    Critical · 9.6 CVE-2023-35160 >= 2.5-milestone-2, < 14.10.5, >= 15.0-rc-1, < 15.1-rc-1 14.10.5, 15.1-rc-1
  9. XWiki Platform vulnerable to reflected cross-site scripting via xredirect parameter in deletespace template
    Critical · 9.6 CVE-2023-35159 >= 3.4-milestone-1, < 14.10.5, >= 15.0-rc-1, < 15.1-rc-1 14.10.5, 15.1-rc-1
  10. XWiki vulnerable to stored cross-site scripting via any wiki document and the displaycontent/rendercontent template
    Critical · 9.0 CVE-2023-34464 < 14.4.8, >= 14.5, < 14.10.5, >= 15.0-rc-1, < 15.1-rc-1 14.4.8, 14.10.5, 15.1-rc-1
  11. xwiki-platform-web-templates vulnerable to Eval Injection
    Critical · 9.9 CVE-2023-29512 >= 1.0B1, < 13.10.11, >= 14.0-rc-1, < 14.4.8, >= 14.5, < 14.10.1 13.10.11, 14.4.8, 14.10.1
  12. Improper Neutralization of Script-Related HTML Tags (XSS) in the LiveTable Macro
    High · 8.9 CVE-2023-29207 >= 1.9-milestone-2, < 13.10.10, >= 14.0-rc-1, < 14.4.6, >= 14.5, < 14.9 13.10.10, 14.4.6, 14.9
  13. XWiki Platform Web Templates vulnerable to Missing Authorization, Exposure of Private Personal Information to Unauthorized Actor
    High · 7.5 CVE-2022-36091 >= 1.3, < 13.10.4 13.10.4
  14. XWiki Platform Web Templates vulnerable to Unauthorized User Registration Through the Distribution Wizard
    High · 8.5 CVE-2022-36093 < 13.10.5, >= 14.0, < 14.3-rc-1 13.10.5, 14.3-rc-1
  15. Cross site scripting in registration template in xwiki-platform
    High · 7.4 CVE-2022-23622 >= 2.6.1, < 12.10.11, >= 13.0.0, < 13.4.7, >= 13.10.0, < 13.10.3 12.10.11, 13.4.7, 13.10.3

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.