This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.

[TLP:CLEAR] XWiki fixes 2 critical vulnerabilities

XWiki versions 13.10.11, 14.4.7 and 14.10 fix two critical vulnerabilities [1][2].

XWiki - XSS (CVE-2025-53835 )
CVSS 9.0 (Critical)

An authenticated remote attacker with permission to edit documents is, due to the XHTML syntax's dependence on 'xdom+xml/current', which allows arbitrary HTML including JavaScript to be embedded, allowed to carry out an XSS attack [1].

The vulnerability is present in product:

  • XWiki; >=5.4.5, <14.10

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

More information:

  • CVE-2025-53835 at cve.org, NVD
  • CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) at cwe.mitre.org

The vulnerability was publicly disclosed 14. 7. 2025.

XWiki - RCE (CVE-2025-53836)
CVSS 9.9 (Critical)

An authenticated remote attacker is, due to incorrect preservation of the “restricted” attribute when executing nested macros, allowed to run forbidden macros, which may lead to privilege escalation and remote code execution [2].

The vulnerability is present in product:

  • XWiki; >=4.2-milestone-1, <13.10.11; >=14.0, <14.4.7; >=14.5, <14.10

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 14. 7. 2025.

By CESNET, z.s.p.o. Michaela Jarošová on 15. 7. 2025.

CESNET, z.s.p.o. Logo