CVE-2025-83837: XWiki-Rendering Eval Injection Vulnerability Analysis

Vulnerability Summary: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in xwiki-rendering Vulnerability Overview Vulnerability Name: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') Affected Package: Severity Level: Critical (CVSS 9.0 / 10) CWE: CWE-95 CVE: CVE-2025-83837 Publisher: michitux, published as GHSA-26vp-8g9g-vd9q Scope of Impact Affected Versions: < 14.10.2 Fixed Versions: 14.10.2, 15.0-rc1 Impact Description: Any user capable of editing user profile settings or other documents can execute arbitrary script macros (including Groovy and Python macros), thereby gaining unintended read/write permissions over XWiki content. This occurs because the rendered output contains HTML content where macros are not properly escaped, allowing attackers to close the HTML structure and inject macros that execute with programming privileges. POC / Exploit Code `` XWiki.JSExtensionClass { {html_wiki=true} {-{-{-h-a-n-}--{-{-c-a-n-h-a-n-}--{-p-r-i-n-t-l-n-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2025-83837: XWiki-Rendering Eval Injection Vulnerability Analysis

More from this source