VYPR
← All advisories
High severityNVD Advisory· Published Apr 18, 2023· Updated Feb 6, 2025

Code injection from account/view through VFS Tree macro in xwiki-platform

CVE-2023-29521

Description

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with view rights can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation. The root cause is improper escaping of Macro.VFSTreeMacro. This page is not installed by default.This vulnerability has been patched in XWiki 15.0-rc-1, 14.10.2, 14.4.8, 13.10.11. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
org.xwiki.platform:xwiki-platform-vfs-uiMaven
>= 7.4-milestone-2, < 13.10.1113.10.11
org.xwiki.platform:xwiki-platform-vfs-uiMaven
>= 14.0-rc-1, < 14.4.814.4.8
org.xwiki.platform:xwiki-platform-vfs-uiMaven
>= 14.5, < 14.10.214.10.2

Affected products

1

Patches

1
fad02328f5ec

XWIKI-20260: Improved escaping of VFSTreeMacro

https://github.com/xwiki/xwiki-platformManuel LeducDec 16, 2022via ghsa
commit
2 files changed · +9 −1
  • xwiki-platform-core/xwiki-platform-vfs/xwiki-platform-vfs-ui/pom.xml+6 −0 modified
    @@ -55,6 +55,12 @@
       <type>xar</type>
       <scope>runtime</scope>
     </dependency>
+    <dependency>
+      <groupId>org.xwiki.platform</groupId>
+      <artifactId>xwiki-platform-rendering-xwiki</artifactId>
+      <version>${project.version}</version>
+      <scope>runtime</scope>
+    </dependency>
     <!-- Needed for Wiki Macros -->
     <dependency>
       <groupId>org.xwiki.platform</groupId>
  • xwiki-platform-core/xwiki-platform-vfs/xwiki-platform-vfs-ui/src/main/resources/Macros/VFSTreeMacro.xml+3 −1 modified
    @@ -250,7 +250,9 @@
     </property>
     <property>
       <code>{{velocity}}
-{{tree root="$xcontext.macro.params.root" reference="path:$xwiki.getURL($doc.getDocumentReference(), 'get', 'sheet=Macros.VFSTreeJSON&amp;outputSyntax=plain')" links="true"/}}
+#set ($root = $services.rendering.escape($xcontext.macro.params.root, 'xwiki/2.1'))
+#set ($reference = $services.rendering.escape("path:$xwiki.getURL($doc.getDocumentReference(), 'get', 'sheet=Macros.VFSTreeJSON&amp;outputSyntax=plain')", 'xwiki/2.1'))
+{{tree root="$root" reference="$reference" links="true"/}}
 {{/velocity}}</code>
     </property>
     <property>

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

5

News mentions

0

No linked articles in our index yet.