What’s Vulnerable › Vulnerabilities

CVE-2022-24898: Arbitrary file access through XML parsing in org.xwiki.commons:xwiki-commons-xml

• Severity: medium (CVSS 4.9 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2022-04-28 · updated 2026-06-17
• Weakness: CWE-611

Description

org.xwiki.commons:xwiki-commons-xml is a common module used by other XWiki top level projects. Starting in version 2.7 and prior to versions 12.10.10, 13.4.4, and 13.8-rc-1, it is possible for a script to access any file accessing to the user running XWiki application server with XML External Entity Injection through the XML script service. The problem has been patched in versions 12.10.10, 13.4.4, and 13.8-rc-1. There is no easy workaround for fixing this vulnerability other than upgrading and being careful when giving Script rights.

Affected products

• xwiki Commons: from 2.7 before 12.10.10; from 13.0 before 13.4.4; from 13.5 before 13.8 — fixed in 12.10.10, 13.4.4, 13.8

How to fix

Upgrade to a fixed version: xwiki Commons 12.10.10, 13.4.4, 13.8. Check the vendor advisory for mitigations.

References

• https://github.com/xwiki/xwiki-commons/commit/947e8921ebd95462d5a7928f397dd1b64f77c7d5
• https://github.com/xwiki/xwiki-commons/security/advisories/GHSA-m2r5-4w96-qxg5
• https://jira.xwiki.org/browse/XWIKI-18946
• https://github.com/xwiki/xwiki-commons/commit/947e8921ebd95462d5a7928f397dd1b64f77c7d5
• https://github.com/xwiki/xwiki-commons/security/advisories/GHSA-m2r5-4w96-qxg5
• https://jira.xwiki.org/browse/XWIKI-18946

Get alerted when CVE-2022-24898 or the next vulnerability affects your stack