xwiki/xwiki-commons Security Advisories | GitStock

critical2026-05-26

XWiki Platform has path traversal via resources parameter in ssx and jsx endpoints when using leading slash

GHSA-xq3r-2qv5-vqqm · CVE-2026-23734

critical2024-04-10

XWiki Commons missing escaping of `{` in Velocity escapetool allows remote code execution

GHSA-hf43-47q4-fhq5 · CVE-2024-31996

critical2023-06-30

org.xwiki.commons:xwiki-commons-xml's HTML sanitizer allows form elements in restricted

GHSA-6pqf-c99p-758v · CVE-2023-36471

critical2023-05-09

Improper Neutralization of Invalid Characters in Data Attribute Names in org.xwiki.commons:xwiki-commons-xml

GHSA-pv7v-ph6g-3gxv · CVE-2023-31126

critical2023-04-20

Cross-site Scripting in org.xwiki.commons:xwiki-commons-xml

GHSA-x37v-36wv-6v6h · CVE-2023-29528

critical2023-04-12

org.xwiki.commons:xwiki-commons-xml Cross-site Scripting vulnerability

GHSA-m3jr-cvhj-f35j · CVE-2023-29201

critical2023-03-03

XWiki Platform may allow privilege escalation to programming rights via user's first name

GHSA-8cw6-4r32-6r3h · CVE-2023-26055

high2022-04-28

Arbitrary filesystem write access from velocity.

GHSA-cvx5-m8vg-vxgc · CVE-2022-24897

medium2022-04-28

Arbitrary file access through XML parsing in org.xwiki.commons:xwiki-commons-xml

GHSA-m2r5-4w96-qxg5 · CVE-2022-24898