Executive brief
XWiki's rendering engine fails to properly escape output when rendering content within HTML macros, allowing authenticated users to inject and execute arbitrary script code (Groovy, Python) with full system privileges. An attacker with access to edit their user profile or other documents can execute remote code, read and modify all wiki contents, and compromise the entire installation.
Technical details
The vulnerability is an eval injection flaw in the org.xwiki.rendering:xwiki-rendering-xml component where rendering output is inserted into HTML macros without proper escaping. This allows an attacker to close the HTML macro context and inject nested script macros (e.g., {{groovy}}) that execute with programming rights. The vulnerability affects at minimum XWiki 2.x syntax and is confirmed exploitable in XWiki 3.3 Milestone 1 via user profile editing, and in XWiki 8.3+ via extension points like org.xwiki.platform.search.ui.docdoesnotexist. The attack requires authentication (ability to edit a document), but can be triggered by any user with document editing permissions. Patches are available in XWiki 14.10.2 and 15.0 RC1.
Affected products
- XWiki xwiki-rendering-xml up to 14.10.1 and 15.0 RC0
Timeline
- 2026-09-18: disclosed: Advisory published