Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2025-53837— org.xwiki.rendering:xwiki-rendering-xml has an Eval Injection issue

Quick assessment

Affected
xwiki xwiki-rendering
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

XWiki Rendering 是一个通用的渲染系统，能够将给定语法（如 Wiki 语法、HTML 等）的文本输入转换为另一种语法（如 XHTML 等）。 在 XWiki 14.10.2 和 15.0 RC1 之前的版本中，任何能够编辑自己用户档案或其他文档的用户，都可以执行任意脚本宏（包括 Groovy 和 Python 宏），从而实现远程代码执行，并获得对 Wiki 所有内容的无限制读取和写入权限。 其根本原因在于：渲染后的输出结果被作为 HTML 宏的内容包含在内，且未进行进一步转义。因此，攻击者可以关闭当前

CVSS 9.9 · Critical EPSS 0.64% · P49

Affected Version Matrix 1

VendorProduct Version RangeStatus
xwiki xwiki-rendering < 14.10.2 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2025-53837

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
org.xwiki.rendering:xwiki-rendering-xml has an Eval Injection issue
Source: CVE Program / CVE List V5
Vulnerability Description
XWiki Rendering is a generic rendering system that converts textual input in a given syntax (wiki syntax, HTML, etc) into another syntax (XHTML, etc). Prior to versions 14.10.2 and 15.0 RC1, any user who can edit their own user profile or any other document can execute arbitrary script macros including Groovy and Python macros that allow remote code execution including unrestricted read and write access to all wiki contents. The reason is that rendering output is included as content of HTML macros without further escaping and it is thus possible to close the HTML macro and inject script macros that are executed with programming rights. This has been patched in XWiki 14.10.2 and 15.0 RC1 by making sure that rendering output cannot close the surrounding HTML macro. A possible workaround is available. It is, in principle, possible to add escaping to all places where rendering output is used in wiki documents, but at the moment there is no list of them.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
动态执行代码中指令转义处理不恰当(Eval注入)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
xwiki xwiki-rendering < 14.10.2 -

II. Public POCs for CVE-2025-53837

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2025-53837

请登录查看更多情报信息。

Patches & Fixes for CVE-2025-53837 (1)

Other References for CVE-2025-53837 (6)

IV. Related Vulnerabilities

Same product: xwiki-rendering
Same vendor: xwiki
Same weakness: CWE-95

V. Comments for CVE-2025-53837

No comments yet

Leave a comment