XWiki Platform: Privilege escalation (PR) from user registration through PDFClassGHSA-vxwr-wpjv-qjq7
CRITICALFix: xwiki/xwiki-platform@480186fGHSA-vxwr-wpjv-qjq7 is a critical-severity (CVSS 9.9) CWE-862 vulnerability in org.xwiki.platform:xwiki-platform-oldcore. 1 public exploit or proof-of-concept reference is indexed, so weaponization risk is real. A fix is available for org.xwiki.platform:xwiki-platform-oldcore — see the affected versions and patch details below.
Exploitation Status
No confirmed exploitation observed yet
- A successful exploit gives an attacker total control of the affected component, not partial access.
- CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.
Exploitation and automatability from CISA’s SSVC triage for GHSA-vxwr-wpjv-qjq7.
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
Where this sits among everything scored
Real-World Exposure
org.xwiki.platform:xwiki-platform-oldcore☕org.xwiki.platform:xwiki-platform-oldcore☕org.xwiki.platform:xwiki-platform-oldcoreReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects Maven packages — download data is not available via public APIs for these ecosystems.
Description
Impact
Remote code execution is possible via PDF export templates.
To reproduce on an installation, register a new user account with username PDFClass if XWiki.PDFClass does not exist.
On XWiki.PDFClass, use the class editor to add a "style" property of type "TextArea" and content type "Plain Text".
Then, add an object of class PDFClass and set the "style" attribute to $services.logging.getLogger('PDFClass').error("I got programming: $services.security.authorization.hasAccess('programming')").
Finally, go to <host>/xwiki/bin/export/Main/WebHome?format=pdf&pdftemplate=XWiki.PDFClass. If the logs contain "ERROR PDFClass - I got programming: true", the instance is vulnerable.
Patches
This vulnerability has been patched in XWiki 14.10.20, 15.5.4 and 15.10-rc-1.
Workarounds
If PDF templates are not typically used on the instance, an administrator can create the document XWiki.PDFClass and block its edition, after making sure that it does not contain a style attribute.
Otherwise, the instance needs to be updated.
References
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| ☕Maven | org.xwiki.platform:xwiki-platform-oldcore | ≥ 3.0.1&&< 14.10.20 | 14.10.20org.xwiki.platform:xwiki-platform-oldcore:14.10.20 |
| ☕Maven | org.xwiki.platform:xwiki-platform-oldcore | ≥ 15.0-rc-1&&< 15.5.4 | 15.5.4org.xwiki.platform:xwiki-platform-oldcore:15.5.4 |
| ☕Maven | org.xwiki.platform:xwiki-platform-oldcore | ≥ 15.6-rc-1&&< 15.10-rc-1 | 15.10-rc-1org.xwiki.platform:xwiki-platform-oldcore:15.10-rc-1 |
Affected Products
xwikixwikiResearch use only. For defensive security, authorized penetration testing, and academic research only. Never execute exploit code against systems without explicit written authorization.
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for org.xwiki.platform:xwiki-platform-oldcore, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update org.xwiki.platform:xwiki-platform-oldcore to 14.10.20 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-vxwr-wpjv-qjq7 is resolved across your whole dependency graph.
Workarounds
Put an independent control in front of the weakness: restrict the affected endpoint or interface to trusted networks, require an additional authentication factor or proxy-level check, and invalidate existing sessions and credentials in case the flaw has already been used.
Frequently Asked Questions
Is GHSA-vxwr-wpjv-qjq7 in your dependencies?
Find it across Maven, including transitive dependencies.