What’s Vulnerable › Vulnerabilities

CVE-2021-32621: Script injection without script or programming rights through Gadget titles

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.1% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2021-05-28 · updated 2026-06-17
• Weakness: CWE-94

Description

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions prior to 12.6.7 and 12.10.3, a user without Script or Programming right is able to execute script requiring privileges by editing gadget titles in the dashboard. The issue has been patched in XWiki 12.6.7, 12.10.3 and 13.0RC1.

Affected products

• xwiki-platform: from 3.0.1 before 12.6.7; from 12.10 before 12.10.3; 3.0, 3.0-milestone3, 3.0-rc1 — fixed in 12.10.3, 12.6.7

How to fix

Upgrade to a fixed version: xwiki-platform 12.10.3, 12.6.7. Check the vendor advisory for mitigations.

References

• https://github.com/xwiki/xwiki-platform/commit/bb7068bd911f91e5511f3cfb03276c7ac81100bc
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-h353-hc43-95vc
• https://jay-from-future.github.io/cve/2021/06/17/xwiki-rce-cve.html
• https://jira.xwiki.org/browse/XWIKI-17794
• https://github.com/xwiki/xwiki-platform/commit/bb7068bd911f91e5511f3cfb03276c7ac81100bc
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-h353-hc43-95vc
• https://jay-from-future.github.io/cve/2021/06/17/xwiki-rce-cve.html
• https://jira.xwiki.org/browse/XWIKI-17794

Get alerted when CVE-2021-32621 or the next vulnerability affects your stack