Research · Feb 20, 2025 · ZeroDay Catalog
Critical Eval Injection Vulnerability in XWiki Platform
A critical evaluation injection vulnerability has been identified in the XWiki Platform, allowing unauthorized remote code execution. Users are urged to upgrade to mitigate risks.
What changed
A significant vulnerability has been discovered in the XWiki Platform, enabling arbitrary remote code execution by unauthenticated users. This flaw compromises the confidentiality, integrity, and availability of the entire XWiki installation.
The vulnerability has been addressed in recent updates, specifically in versions 15.10.11, 16.4.1, and 16.5.0RC1.
Who is affected
Organizations utilizing the XWiki Platform for their applications are at risk. This includes any instance that allows guest access.
The vulnerability can potentially affect all users who have not updated to the patched versions.
- XWiki Platform users
- Organizations relying on XWiki for collaborative applications
- Developers building on top of the XWiki framework
- IT administrators managing XWiki installations
What to do
It is highly recommended that all users upgrade their XWiki installations to the latest versions to mitigate the risk associated with this vulnerability.
For those unable to perform an upgrade immediately, a temporary workaround involves editing specific lines in the configuration to adjust the content type.
- Upgrade to XWiki 15.10.11, 16.4.1, or 16.5.0RC1 as soon as possible.
- Review and apply the recommended configuration changes if an immediate upgrade is not feasible.
- Monitor XWiki's official channels for further updates and security advisories.