Executive brief
XWiki is a collaborative platform used by organizations to manage knowledge and build internal applications. A security flaw in its scripting engine allows users with basic 'script' permissions to bypass security restrictions and execute unauthorized code on the server. This could allow an attacker to take full control of the XWiki instance, leading to the theft of sensitive data, modification of content, or a complete service shutdown.
Technical details
A sandbox bypass vulnerability exists in XWiki Platform's Velocity scripting API. The root cause is an improperly protected scripting API, specifically within ScriptXWikiServletRequest#getRequest(), which allows access to the underlying ServletContext. An authenticated attacker with 'script' rights can use this access to instantiate arbitrary classes (such as JPythonInterpreter) via the Tomcat InstanceManager, bypassing the Velocity sandbox to execute arbitrary Python scripts or OS commands. This vulnerability affects XWiki versions starting from 17.0.0-rc-1 and is fixed in versions 17.4.8 and 17.10.1 by requiring 'programming' rights to access the sensitive API.
Affected products
- XWiki XWiki Platform >= 17.0.0-rc-1, < 17.4.8; >= 17.5.0-rc-1, < 17.10.1
- org.xwiki.platform xwiki-platform-oldcore >= 17.0.0-rc-1, < 17.4.8; >= 17.5.0-rc-1, < 17.10.1
- org.xwiki.platform xwiki-platform-legacy-oldcore >= 17.0.0-rc-1, < 17.4.8; >= 17.5.0-rc-1, < 17.10.1
Timeline
- 2025-11-07: other: Initial bug report in XWiki Jira
- 2025-12-10: patched: Issue resolved in development branch
- 2026-04-08: disclosed: Security advisory published