What’s Vulnerable › Vulnerabilities

CVE-2022-24897: Arbitrary filesystem write access from Velocity

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.8% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2022-05-02 · updated 2026-06-17
• Weakness: CWE-22

Description

APIs to evaluate content with Velocity is a package for APIs to evaluate content with Velocity. Starting with version 2.3 and prior to 12.6.7, 12.10.3, and 13.0, the velocity scripts are not properly sandboxed against using the Java File API to perform read or write operations on the filesystem. Writing an attacking script in Velocity requires the Script rights in XWiki so not all users can use it, and it also requires finding an XWiki API which returns a File. The problem has been patched in versions 12.6.7, 12.10.3, and 13.0. There is no easy workaround for fixing this vulnerability other than upgrading and being careful when giving Script rights.

Affected products

• xwiki-platform: from 2.3 before 12.6.7; from 12.7 before 12.10.3 — fixed in 12.10.3, 12.6.7

How to fix

Upgrade to a fixed version: xwiki-platform 12.10.3, 12.6.7. Check the vendor advisory for mitigations.

References

• https://github.com/xwiki/xwiki-commons/commit/215951cfb0f808d0bf5b1097c9e7d1e503449ab8
• https://github.com/xwiki/xwiki-commons/pull/127
• https://github.com/xwiki/xwiki-commons/security/advisories/GHSA-cvx5-m8vg-vxgc
• https://jira.xwiki.org/browse/XWIKI-5168
• https://github.com/xwiki/xwiki-commons/commit/215951cfb0f808d0bf5b1097c9e7d1e503449ab8
• https://github.com/xwiki/xwiki-commons/pull/127
• https://github.com/xwiki/xwiki-commons/security/advisories/GHSA-cvx5-m8vg-vxgc
• https://jira.xwiki.org/browse/XWIKI-5168

Get alerted when CVE-2022-24897 or the next vulnerability affects your stack