xwiki/xwiki-platform Security Advisories | GitStock

high2026-08-19

XWiki Platform Live Data Live Table Connector has privilege escalation from edit to script right through Live Data editing

GHSA-45ph-gxxr-gwgw · CVE-2026-53966

high2026-07-07

XWiki Platform Old Core: Resource path traversal via /skin/ action endpoint in Jetty 12+

GHSA-qj4x-9g63-25g6 · CVE-2026-34151

high2026-05-26

XWiki Platform's Livetable results still allow reconstructing password hashes using 768 requests

GHSA-rh28-mqj4-8x59 · CVE-2026-48048

medium2026-05-26

XWiki Platform vulnerable to potential arbitrary file writing using path traversal from (subwiki) admin

GHSA-vgwr-23fq-pr7g · CVE-2026-48047

critical2026-05-26

XWiki Platform has an Unauthenticated XAR Import via REST /wikis/{wikiName}

GHSA-qrvh-r3f2-9h4r · CVE-2026-33137

medium2026-04-14

XWiki's REST APIs can list all pages/spaces, leading to unavailability

GHSA-mrqg-xmgm-rc5g · CVE-2026-40104

medium2026-04-14

XWiki has Reflected Cross-Site Scripting (XSS) in page history compare

GHSA-w4fj-87j5-f25c · CVE-2026-40105

high2026-04-08

XWiki vulnerable to remote code execution with script right through unprotected Velocity scripting API

GHSA-h259-74h5-4rh9 · CVE-2026-33229

medium2026-02-12

XWiki vulnerable to click-jacking through CSS injection in comments

GHSA-74rh-c5rh-88vg · CVE-2026-26000

medium2026-01-23

XWiki Affected by Reflected Cross-Site Scripting (XSS) in Error Messages

GHSA-wvqx-m5px-6cmp · CVE-2026-24128

high2025-12-10

XWiki's REST APIs don't enforce any limits, leading to unavailability and OOM in large wikis

GHSA-cc84-q3v3-mhgf · CVE-2025-66473

medium2025-12-10

XWiki vulnerable to a reflected XSS via xredirect parameter in DeleteApplication

GHSA-7vpr-jm38-wr7w · CVE-2025-66472

high2025-12-01

XWiki Jetty Package (XJetty) allows accessing any application file through URL

GHSA-53gx-j3p6-2rw9 · CVE-2025-55749

critical2025-10-06

XWiki Platform is vulnerable to HQL injection via wiki and space search REST API

GHSA-gprp-h92g-gc2h · CVE-2025-52472

critical2025-09-03

XWiki configuration files can be accessed through jsx and sx endpoints

GHSA-m63c-3rmg-r2cf · CVE-2025-55748

critical2025-09-03

XWiki configuration files can be accessed through the webjars API

GHSA-qww7-89xh-x7m7 · CVE-2025-55747

medium2025-08-28

XWiki PDF export jobs store sensitive cookies unencrypted in job statuses

GHSA-9m7c-m33f-3429 · CVE-2025-58049

high2025-08-05

XWiki exposes passwords and emails stored in fields not named password/email in xml.vm

GHSA-57q2-6cp4-9mq3 · CVE-2025-54125

high2025-08-05

XWiki leaks password hashes and other accessible password properties

GHSA-r38m-cgpg-qj69 · CVE-2025-54124

medium2025-08-05

XWiki allows Reflected XSS in two templates

GHSA-m9x4-w7p9-mxhx · CVE-2025-32430