VYPR
High severityOSV Advisory· Published Sep 8, 2025· Updated Apr 15, 2026

CVE-2025-58365

CVE-2025-58365

Description

The XWiki blog application allows users of the XWiki platform to create and manage blog posts. Prior to version 9.14, the blog application in XWiki allowed remote code execution for any user who has edit right on any page. Normally, these are all logged-in users as they can edit their own user profile. For an exploit, it is sufficient to add an object of type Blog.BlogPostClass to any page and to add some script macro with the exploit code to the "Content" field of that object. The vulnerability has been patched in the blog application version 9.14 by executing the content of blog posts with the rights of the appropriate author. No known workarounds are available.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
org.xwiki.contrib.blog:application-blog-uiMaven
< 9.149.14

Affected products

1

Patches

2
83d5f24faf91

[maven-release-plugin] prepare release application-blog-9.14

6 files changed · +7 7
  • application-blog-api/pom.xml+1 1 modified
    @@ -25,7 +25,7 @@
       <parent>
         <groupId>org.xwiki.contrib.blog</groupId>
         <artifactId>application-blog</artifactId>
    -    <version>9.13.13-SNAPSHOT</version>
    +    <version>9.14</version>
       </parent>
       <artifactId>application-blog-api</artifactId>
       <name>Blog - API</name>
    
  • application-blog-test/application-blog-test-pageobjects/pom.xml+1 1 modified
    @@ -25,7 +25,7 @@
       <parent>
         <groupId>org.xwiki.contrib.blog</groupId>
         <artifactId>application-blog-test</artifactId>
    -    <version>9.13.13-SNAPSHOT</version>
    +    <version>9.14</version>
       </parent>
       <artifactId>application-blog-test-pageobjects</artifactId>
       <name>Blog - Tests - Page Objects</name>
    
  • application-blog-test/application-blog-test-tests/pom.xml+1 1 modified
    @@ -25,7 +25,7 @@
       <parent>
         <groupId>org.xwiki.contrib.blog</groupId>
         <artifactId>application-blog-test</artifactId>
    -    <version>9.13.13-SNAPSHOT</version>
    +    <version>9.14</version>
       </parent>
       <artifactId>application-blog-test-tests</artifactId>
       <name>Blog - Tests - Functional Tests</name>
    
  • application-blog-test/pom.xml+1 1 modified
    @@ -25,7 +25,7 @@
       <parent>
         <groupId>org.xwiki.contrib.blog</groupId>
         <artifactId>application-blog</artifactId>
    -    <version>9.13.13-SNAPSHOT</version>
    +    <version>9.14</version>
       </parent>
       <artifactId>application-blog-test</artifactId>
       <name>Blog - Tests - Parent POM</name>
    
  • application-blog-ui/pom.xml+1 1 modified
    @@ -25,7 +25,7 @@
       <parent>
         <groupId>org.xwiki.contrib.blog</groupId>
         <artifactId>application-blog</artifactId>
    -    <version>9.13.13-SNAPSHOT</version>
    +    <version>9.14</version>
       </parent>
       <!-- If someone has to change the ID, he must update org.xwiki.platform.blog.internal.BlogUpgradeEventListener to
            consider the new ID as well -->
    
  • pom.xml+2 2 modified
    @@ -29,15 +29,15 @@
       </parent>
       <groupId>org.xwiki.contrib.blog</groupId>
       <artifactId>application-blog</artifactId>
    -  <version>9.13.13-SNAPSHOT</version>
    +  <version>9.14</version>
       <name>Blog - Parent POM</name>
       <packaging>pom</packaging>
       <description>Create and manage blog posts</description>
       <scm>
         <connection>scm:git:git://github.com/xwiki-contrib/application-blog.git</connection>
         <developerConnection>scm:git:git@github.com:xwiki-contrib/application-blog.git</developerConnection>
         <url>https://github.com/xwiki-contrib/application-blog/tree/master</url>
    -    <tag>HEAD</tag>
    +    <tag>application-blog-9.14</tag>
       </scm>
       <developers>
         <developer>
    
b98ab6f17da3

BLOG-191: Content is wrongly rendered

https://github.com/xwiki-contrib/application-blogMichael HamannMay 5, 2025via ghsa
9 files changed · +328 26
  • application-blog-api/pom.xml+12 0 modified
    @@ -52,6 +52,11 @@
           <groupId>javax.servlet</groupId>
           <artifactId>javax.servlet-api</artifactId>
         </dependency>
    +    <dependency>
    +      <groupId>org.xwiki.rendering</groupId>
    +      <artifactId>xwiki-rendering-syntax-html5</artifactId>
    +      <version>${rendering.version}</version>
    +    </dependency>
         <!-- Test Dependencies -->
         <dependency>
           <groupId>org.xwiki.commons</groupId>
    @@ -66,5 +71,12 @@
           <version>2.6.3</version>
           <scope>test</scope>
         </dependency>
    +    <dependency>
    +      <groupId>org.xwiki.platform</groupId>
    +      <artifactId>xwiki-platform-oldcore</artifactId>
    +      <version>${platform.version}</version>
    +      <type>test-jar</type>
    +      <scope>test</scope>
    +    </dependency>
       </dependencies>
     </project>
    \ No newline at end of file
    
  • application-blog-api/src/main/java/org/xwiki/contrib/blog/script/BlogScriptService.java+111 0 modified
    @@ -19,18 +19,31 @@
      */
     package org.xwiki.contrib.blog.script;
     
    +import java.util.Collections;
    +
     import javax.inject.Inject;
     import javax.inject.Named;
     import javax.inject.Provider;
     import javax.inject.Singleton;
     
    +import org.apache.commons.lang3.StringUtils;
     import org.xwiki.component.annotation.Component;
    +import org.xwiki.localization.ContextualLocalizationManager;
    +import org.xwiki.model.reference.EntityReferenceSerializer;
    +import org.xwiki.rendering.block.Block;
    +import org.xwiki.rendering.block.LinkBlock;
    +import org.xwiki.rendering.block.WordBlock;
    +import org.xwiki.rendering.listener.reference.DocumentResourceReference;
    +import org.xwiki.rendering.renderer.BlockRenderer;
    +import org.xwiki.rendering.renderer.printer.DefaultWikiPrinter;
     import org.xwiki.script.service.ScriptService;
     import org.xwiki.stability.Unstable;
     
     import com.xpn.xwiki.XWikiContext;
     import com.xpn.xwiki.XWikiException;
     import com.xpn.xwiki.api.Document;
    +import com.xpn.xwiki.api.Object;
    +import com.xpn.xwiki.api.Property;
     import com.xpn.xwiki.web.ExternalServletURLFactory;
     import com.xpn.xwiki.web.XWikiURLFactory;
     
    @@ -46,9 +59,26 @@
     @Unstable
     public class BlogScriptService implements ScriptService
     {
    +
    +    private static final String EXTRACT_PROPERTY_NAME = "extract";
    +
    +    private static final String PARAGRAPH_CLOSE_TAG = "</p>";
    +
    +    private static final String VIEW_MODE = "view";
    +
         @Inject
         private Provider<XWikiContext> xwikiContextProvider;
     
    +    @Inject
    +    private ContextualLocalizationManager localizationManager;
    +
    +    @Inject
    +    @Named("html/5.0")
    +    private BlockRenderer htmlRenderer;
    +
    +    @Inject
    +    private EntityReferenceSerializer<String> referenceSerializer;
    +
         /**
          * @param document the document containing the attachment
          * @param filename the document's attachment for which to generate an absolute URL for
    @@ -70,7 +100,9 @@ public String getExternalAttachmentURL(Document document, String filename)
          * @param blogDocument the document containing the content to render
          * @return the rendered content as HTML
          * @throws XWikiException if there's an error when rendering the content to HTML
    +     * @deprecated Since 9.14, use {@link #renderContentHTML(Document, Object, boolean, boolean, boolean)} instead.
          */
    +    @Deprecated
         public String renderRSSDescription(String contentToRender, Document blogDocument) throws XWikiException
         {
             XWikiContext context = this.xwikiContextProvider.get();
    @@ -82,4 +114,83 @@ public String renderRSSDescription(String contentToRender, Document blogDocument
                 context.setURLFactory(currentURLFactory);
             }
         }
    +
    +    /**
    +     * Renders the content of the specified blog post document to HTML, with options for using the extract if available,
    +     * adding ellipses, and generating external URLs.
    +     *
    +     * @param blogDocument the document representing the blog post
    +     * @param blogPostObject the object containing the blog post data
    +     * @param onlyExtract if true, renders the "extract" field of the blog post object (when present) instead of the
    +     * full content
    +     * @param removeEllipsis if true, no ellipsis ("...") will be appended to the extract
    +     * @param externalURLs if true, forces URLs included in the rendered content to be external
    +     * @return a string representing the rendered HTML content of the blog post
    +     * @since 9.14
    +     */
    +    public String renderContentHTML(Document blogDocument, Object blogPostObject, boolean onlyExtract,
    +        boolean removeEllipsis, boolean externalURLs)
    +    {
    +        XWikiContext context = this.xwikiContextProvider.get();
    +        XWikiURLFactory currentURLFactory = context.getURLFactory();
    +        try {
    +            if (externalURLs) {
    +                context.setURLFactory(new ExternalServletURLFactory(context));
    +            }
    +
    +            boolean useExtract = onlyExtract && hasExtract(blogPostObject);
    +
    +            String result;
    +
    +            if (useExtract) {
    +                result = unwrapHTMLMacro(blogDocument.display(EXTRACT_PROPERTY_NAME, VIEW_MODE, blogPostObject));
    +
    +                if (!removeEllipsis) {
    +                    String title = this.localizationManager.getTranslationPlain("blog.code.readpost");
    +                    String stringReference = this.referenceSerializer.serialize(blogDocument.getDocumentReference());
    +                    Block linkBlock = new LinkBlock(
    +                        Collections.singletonList(new WordBlock("…")),
    +                        new DocumentResourceReference(stringReference),
    +                        false,
    +                        Collections.singletonMap("title", title)
    +                    );
    +                    DefaultWikiPrinter printer = new DefaultWikiPrinter();
    +                    this.htmlRenderer.render(linkBlock, printer);
    +
    +                    String ellipsis = printer.toString();
    +
    +                    // Check if the (trimmed) content ends with a closing paragraph tag.
    +                    // If yes, add the ellipsis inside that last paragraph, else add it as a new paragraph.
    +                    if (StringUtils.lastIndexOf(result, PARAGRAPH_CLOSE_TAG) > 0
    +                        && StringUtils.isBlank(StringUtils.substringAfterLast(result, PARAGRAPH_CLOSE_TAG))) {
    +                        result = StringUtils.substringBeforeLast(result,
    +                            PARAGRAPH_CLOSE_TAG) + " " + ellipsis + PARAGRAPH_CLOSE_TAG;
    +                    } else {
    +                        result = result + "<p>" + ellipsis + PARAGRAPH_CLOSE_TAG;
    +                    }
    +                }
    +            } else {
    +                result = unwrapHTMLMacro(blogDocument.display("content", VIEW_MODE, blogPostObject));
    +            }
    +
    +            return result;
    +        } finally {
    +            if (externalURLs) {
    +                context.setURLFactory(currentURLFactory);
    +            }
    +        }
    +    }
    +
    +    private static String unwrapHTMLMacro(String input)
    +    {
    +        return StringUtils.removeEnd(StringUtils.removeStart(input, "{{html clean=\"false\" wiki=\"false\"}}"),
    +            "{{/html}}");
    +    }
    +
    +    private static boolean hasExtract(Object blogPostObject)
    +    {
    +        Property extractProperty = blogPostObject.getProperty(EXTRACT_PROPERTY_NAME);
    +        return extractProperty != null && extractProperty.getValue() != null
    +            && StringUtils.isNotBlank(extractProperty.getValue().toString());
    +    }
     }
    
  • application-blog-api/src/test/java/org/xwiki/contrib/blog/script/BlogScriptServiceTest.java+188 0 added
    @@ -0,0 +1,188 @@
    +/*
    + * See the NOTICE file distributed with this work for additional
    + * information regarding copyright ownership.
    + *
    + * This is free software; you can redistribute it and/or modify it
    + * under the terms of the GNU Lesser General Public License as
    + * published by the Free Software Foundation; either version 2.1 of
    + * the License, or (at your option) any later version.
    + *
    + * This software is distributed in the hope that it will be useful,
    + * but WITHOUT ANY WARRANTY; without even the implied warranty of
    + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
    + * Lesser General Public License for more details.
    + *
    + * You should have received a copy of the GNU Lesser General Public
    + * License along with this software; if not, write to the Free
    + * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
    + * 02110-1301 USA, or see the FSF site: http://www.fsf.org.
    + */
    +package org.xwiki.contrib.blog.script;
    +
    +import java.net.URL;
    +
    +import javax.inject.Provider;
    +
    +import org.junit.Before;
    +import org.junit.Rule;
    +import org.junit.Test;
    +import org.xwiki.component.manager.ComponentManager;
    +import org.xwiki.localization.ContextualLocalizationManager;
    +import org.xwiki.model.reference.DocumentReference;
    +import org.xwiki.rendering.internal.renderer.html5.HTML5BlockRenderer;
    +import org.xwiki.rendering.internal.renderer.html5.HTML5Renderer;
    +import org.xwiki.rendering.internal.renderer.html5.HTML5RendererFactory;
    +import org.xwiki.rendering.internal.renderer.xhtml.image.DefaultXHTMLImageRenderer;
    +import org.xwiki.rendering.internal.renderer.xhtml.image.DefaultXHTMLImageTypeRenderer;
    +import org.xwiki.rendering.internal.renderer.xhtml.link.DefaultXHTMLLinkRenderer;
    +import org.xwiki.rendering.internal.renderer.xhtml.link.DefaultXHTMLLinkTypeRenderer;
    +import org.xwiki.resource.internal.entity.EntityResourceActionLister;
    +import org.xwiki.test.annotation.ComponentList;
    +import org.xwiki.test.mockito.MockitoComponentMockingRule;
    +
    +import com.xpn.xwiki.XWiki;
    +import com.xpn.xwiki.XWikiContext;
    +import com.xpn.xwiki.api.Document;
    +import com.xpn.xwiki.api.Object;
    +import com.xpn.xwiki.api.Property;
    +import com.xpn.xwiki.test.reference.ReferenceComponentList;
    +import com.xpn.xwiki.web.ExternalServletURLFactory;
    +import com.xpn.xwiki.web.Utils;
    +import com.xpn.xwiki.web.XWikiRequest;
    +import com.xpn.xwiki.web.XWikiURLFactory;
    +
    +import static org.junit.Assert.assertEquals;
    +import static org.mockito.Mockito.any;
    +import static org.mockito.Mockito.mock;
    +import static org.mockito.Mockito.never;
    +import static org.mockito.Mockito.verify;
    +import static org.mockito.Mockito.when;
    +
    +/**
    + * Unit test for {@link BlogScriptService}.
    + *
    + * @version $Id$
    + */
    +@ReferenceComponentList
    +@ComponentList({
    +    HTML5BlockRenderer.class,
    +    HTML5Renderer.class,
    +    HTML5RendererFactory.class,
    +    DefaultXHTMLLinkRenderer.class,
    +    DefaultXHTMLLinkTypeRenderer.class,
    +    DefaultXHTMLImageRenderer.class,
    +    DefaultXHTMLImageTypeRenderer.class
    +})
    +public class BlogScriptServiceTest
    +{
    +    private static final DocumentReference DOCUMENT_REFERENCE = new DocumentReference("wiki", "TestBlog", "HelloWorld");
    +
    +    @Rule
    +    public MockitoComponentMockingRule<BlogScriptService> mocker =
    +        new MockitoComponentMockingRule<>(BlogScriptService.class);
    +
    +    BlogScriptService blogScriptService;
    +
    +    private ContextualLocalizationManager localizationManager;
    +
    +    private XWikiContext xwikiContext;
    +
    +    private Document blogDocument;
    +
    +    private Object blogPostObject;
    +
    +    private Property extractProperty;
    +
    +    @Before
    +    public void setUp() throws Exception
    +    {
    +        this.blogDocument = mock(Document.class);
    +        when(this.blogDocument.getDocumentReference()).thenReturn(DOCUMENT_REFERENCE);
    +        this.blogPostObject = mock(Object.class);
    +        this.extractProperty = mock(Property.class);
    +        when(this.blogPostObject.getProperty("extract")).thenReturn(this.extractProperty);
    +        Provider<XWikiContext> contextProvider = this.mocker.registerMockComponent(XWikiContext.TYPE_PROVIDER);
    +        this.blogScriptService = this.mocker.getComponentUnderTest();
    +        this.localizationManager = this.mocker.getInstance(ContextualLocalizationManager.class);
    +        this.xwikiContext = mock(XWikiContext.class);
    +        when(contextProvider.get()).thenReturn(this.xwikiContext);
    +        Utils.setComponentManager(this.mocker);
    +        this.mocker.registerMockComponent(EntityResourceActionLister.class);
    +        this.mocker.registerComponent(ComponentManager.class, "context", this.mocker);
    +
    +        XWiki mockXWiki = mock(XWiki.class);
    +        when(this.xwikiContext.getWiki()).thenReturn(mockXWiki);
    +        when(mockXWiki.getWebAppPath(this.xwikiContext)).thenReturn("xwiki/");
    +        when(this.xwikiContext.getURL()).thenReturn(new URL("https://www.example.com/xwiki/bin/view/Test"));
    +        when(this.xwikiContext.getRequest()).thenReturn(mock(XWikiRequest.class));
    +    }
    +
    +    @Test
    +    public void testRenderContentHTMLWithExtractAndRemoveEllipsis()
    +    {
    +        when(this.extractProperty.getValue()).thenReturn("Test Extract");
    +        when(this.blogDocument.display("extract", "view", this.blogPostObject)).thenReturn(
    +            "{{html clean=\"false\" wiki=\"false\"}}<p>Test Extract</p>{{/html}}");
    +
    +        String result = this.blogScriptService.renderContentHTML(this.blogDocument, this.blogPostObject, true, true, false);
    +
    +        assertEquals("<p>Test Extract</p>", result);
    +        verify(this.xwikiContext, never()).setURLFactory(any());
    +    }
    +
    +    @Test
    +    public void testRenderContentHTMLWithoutExtractAndRemoveEllipsis()
    +    {
    +        when(this.blogPostObject.getProperty("extract")).thenReturn(null);
    +        when(this.blogDocument.display("content", "view", this.blogPostObject)).thenReturn(
    +            "{{html clean=\"false\" wiki=\"false\"}}<p>Full Content</p>{{/html}}");
    +
    +        String result = this.blogScriptService.renderContentHTML(this.blogDocument, this.blogPostObject, true, true, false);
    +
    +        assertEquals("<p>Full Content</p>", result);
    +        verify(this.xwikiContext, never()).setURLFactory(any());
    +    }
    +
    +    @Test
    +    public void testRenderContentHTMLWithExtractAndEllipsis()
    +    {
    +        when(this.extractProperty.getValue()).thenReturn("Test Extract");
    +        when(this.blogDocument.display("extract", "view", this.blogPostObject)).thenReturn(
    +            "{{html clean=\"false\" wiki=\"false\"}}<p>Test Extract</p>{{/html}}");
    +        when(this.localizationManager.getTranslationPlain("blog.code.readpost")).thenReturn("Read more");
    +
    +        String result = this.blogScriptService.renderContentHTML(this.blogDocument, this.blogPostObject, true, false, false);
    +
    +        assertEquals(
    +            "<p>Test Extract <span class=\"wikiexternallink\">"
    +                + "<a title=\"Read more\" href=\"wiki:TestBlog.HelloWorld\">…</a></span></p>", result);
    +        verify(this.xwikiContext, never()).setURLFactory(any());
    +    }
    +
    +    @Test
    +    public void testRenderContentHTMLWithoutExtractAndEllipsis()
    +    {
    +        when(this.blogDocument.display("content", "view", this.blogPostObject)).thenReturn(
    +            "{{html clean=\"false\" wiki=\"false\"}}<p>Full Content</p>{{/html}}");
    +
    +        String result = this.blogScriptService.renderContentHTML(this.blogDocument, this.blogPostObject, false, false, false);
    +
    +        assertEquals("<p>Full Content</p>", result);
    +        verify(this.xwikiContext, never()).setURLFactory(any());
    +    }
    +
    +    @Test
    +    public void testRenderContentHTMLWithExternalURLs()
    +    {
    +        XWikiURLFactory urlFactory = mock(XWikiURLFactory.class);
    +        when(this.xwikiContext.getURLFactory()).thenReturn(urlFactory);
    +        when(this.blogDocument.display("content", "view", this.blogPostObject)).thenReturn(
    +            "{{html clean=\"false\" wiki=\"false\"}}<p>Full Content</p>{{/html}}");
    +
    +        String result = this.blogScriptService.renderContentHTML(this.blogDocument, this.blogPostObject, false, false, true);
    +
    +        assertEquals("<p>Full Content</p>", result);
    +        verify(this.xwikiContext).setURLFactory(any(ExternalServletURLFactory.class));
    +        verify(this.xwikiContext).setURLFactory(urlFactory);
    +    }
    +}
    
  • application-blog-ui/src/main/resources/Blog/BlogCode.xml+10 5 modified
    @@ -732,12 +732,14 @@ $!xwiki.jsx.use($blogScriptsDocumentName)##
      * @param entryObj The xobject of the blog post, an instance of the &lt;tt&gt;Blog.BlogPostClass&lt;/tt&gt; xclass.
      *###
     #macro(displayEntryTitle $entryDoc $entryObj)
    +  #set($escapedRenderedTitle = $services.rendering.escape($entryDoc.display('title', 'view', $entryObj), $xwiki.getCurrentContentSyntaxId()))
       #if($doc.fullName == $entryDoc.fullName)
         (% class="entry-title" %)
    -    = $services.rendering.escape($entryDoc.display('title', 'view', $entryObj), $xwiki.getCurrentContentSyntaxId()) =
    +    = $escapedRenderedTitle =
       #else
         (% class="entry-title" %)
    -    === [[$services.rendering.escape($entryDoc.display('title', 'view', $entryObj),$xwiki.getCurrentContentSyntaxId())&gt;&gt;doc:$services.rendering.escape($services.model.serialize($entryDoc.getDocumentReference(),'default'),$xwiki.getCurrentContentSyntaxId())]] ===
    +    ## Link content requires double escaping.
    +    === [[$services.rendering.escape($escapedRenderedTitle,$xwiki.getCurrentContentSyntaxId())&gt;&gt;doc:$services.rendering.escape($services.model.serialize($entryDoc.getDocumentReference(),'default'),$xwiki.getCurrentContentSyntaxId())]] ===
       #end
     #end
     ##
    @@ -752,10 +754,9 @@ $!xwiki.jsx.use($blogScriptsDocumentName)##
      *###
     #macro(displayEntryContent $entryDoc $entryObj $onlyExtract)
       (% class="#if($onlyExtract)entry-summary#{else}entry-content#end" %)(((
    -  #getEntryContent($entryDoc $entryObj $onlyExtract $entryContent)
       ## FIXME: This causes the blog's content to not be annotatable. See http://jira.xwiki.org/browse/XWIKI-6328
       ##        Should probably be replaced by a display macro call with a reference to the object property holding the post's content
    -  {{html wiki="false"}}$entryDoc.getRenderedContent($entryContent, $entryDoc.syntax.toIdString()){{/html}}
    +  {{html wiki="false"}}$services.blog.renderContentHTML($entryDoc, $entryObj, $onlyExtract, false, false){{/html}}
       ))) ## entry-content
       (% class="clearfloats" %)((()))
     #end
    @@ -772,6 +773,7 @@ $!xwiki.jsx.use($blogScriptsDocumentName)##
      * @param entryContent The resulting content.
      * @param removeEllipsis If &lt;tt&gt;true&lt;/tt&gt;, then don't display an ellipsis at the end of the content (only used when
      *        &lt;tt&gt;onlyExtract&lt;/tt&gt; is &lt;tt&gt;true&lt;/tt&gt;)
    + * @deprecated Use $services.blog.renderContentHTML instead.
      *###
     #macro(getEntryContent $entryDoc $entryObj $onlyExtract $entryContent $removeEllipsis)
       #if ($onlyExtract)
    @@ -875,7 +877,10 @@ $!xwiki.jsx.use($blogScriptsDocumentName)##
               #else
                 , ##
               #end##
    -          [[$!{categoryDoc.getObject($blogCategoryClassname).getValue('name')}&gt;&gt;${category}||rel='tag']]##
    +          #set($escapedName = $services.rendering.escape($categoryDoc.getObject($blogCategoryClassname).getValue('name'), $xwiki.getCurrentContentSyntaxId()))
    +          #set($escapedName = $services.rendering.escape($escapedName, $xwiki.getCurrentContentSyntaxId()))
    +          #set($escapedCategory = $services.rendering.escape($category, $xwiki.getCurrentContentSyntaxId()))
    +          [[$!{escapedName}&gt;&gt;${escapedCategory}||rel='tag']]##
             #end##
           #end##
         #end
    
  • application-blog-ui/src/main/resources/Blog/BlogPostLayoutCards.xml+3 2 modified
    @@ -485,8 +485,9 @@
               #end
               #if ($displaySummaryOnPinnedPosts)
                 &lt;div class="text-left post-summary"&gt;
    -             #set ($postContent = $pObj.getProperty('extract').value)
    -             $!pDoc.getRenderedContent($postContent, $pDoc.syntax.toIdString())
    +            #if ($stringtool.isNotBlank($pObj.getProperty('extract').value))
    +              $services.blog.renderContentHTML($pDoc, $pObj, true, true, false)
    +            #end
                 &lt;/div&gt;
               #end
               #displayPostDetails($pDoc)
    
  • application-blog-ui/src/main/resources/Blog/BlogPostLayoutImage.xml+1 10 modified
    @@ -229,16 +229,7 @@
         &lt;/div&gt;
         #if($displayTitle)&lt;h3 class="entry-title"&gt;&lt;span class="wikilink"&gt;&lt;a href="$postDoc.uRL"&gt;$!postDoc.display('title', 'view', $postObj)&lt;/a&gt;&lt;/span&gt;&lt;/h3&gt;#end
         &lt;div&gt;
    -    #set ($postContent = "")
    -    ## Note: We trim the summary so that if there's some white space it won't cause the summary to be used instead
    -    ## of the content.
    -    #if ($useSummary)
    -      #set ($postContent = $postObj.getProperty('extract').value.trim())
    -    #end
    -    #if ("$!postContent" == '')
    -      #set ($postContent = $postObj.getProperty('content').value)
    -    #end
    -    {{html wiki="false"}}$!postDoc.getRenderedContent($postContent, $postDoc.syntax.toIdString()){{/html}}
    +    {{html wiki="false"}}$services.blog.renderContentHTML($postDoc, $postObj, $useSummary, false, false){{/html}}
         &lt;/div&gt;
         #displayEntryFooter($postDoc $postObj)
       &lt;/div&gt;
    
  • application-blog-ui/src/main/resources/Blog/CategoriesCode.xml+1 1 modified
    @@ -367,7 +367,7 @@
     #macro(displaySimpleCategory $name $level)
       #getEntriesForCategory($name $discard $totalEntries)
       #set($nameUrl = $escapetool.url($name))
    -  #foreach($i in [1..$level])*#end (% class="blog-category-level" %)((( [[#toolImage('rss')&gt;&gt;$name||queryString="xpage=plain&amp;sheet=Blog.CategoryRss" title="RSS"]] &lt;span class="wikilink"&gt;&lt;a href="$services.rendering.escape($xwiki.getURL($name), $xwiki.getCurrentContentSyntaxId())"&gt;#getCategoryName($xwiki.getDocument($name)) &lt;span class="itemCount"&gt;($totalEntries)&lt;/span&gt;&lt;/a&gt;&lt;/span&gt;)))
    +  #foreach($i in [1..$level])*#end (% class="blog-category-level" %)((( [[#toolImage('rss')&gt;&gt;$services.rendering.escape($name, $xwiki.getCurrentContentSyntaxId())||queryString="xpage=plain&amp;sheet=Blog.CategoryRss" title="RSS"]] &lt;span class="wikilink"&gt;&lt;a href="$services.rendering.escape($xwiki.getURL($name), $xwiki.getCurrentContentSyntaxId())"&gt;#getCategoryName($xwiki.getDocument($name)) &lt;span class="itemCount"&gt;($totalEntries)&lt;/span&gt;&lt;/a&gt;&lt;/span&gt;)))
     #end
     ##
     ##
    
  • application-blog-ui/src/main/resources/Blog/CategorySheet.xml+1 1 modified
    @@ -47,7 +47,7 @@
     #set ($obj = $doc.getObject($blogCategoryClassname))
     #if ($obj)
       #if ($tdoc.content.trim() != '')
    -    {{html}}$tdoc.getRenderedContent($tdoc.content, $tdoc.syntax.toIdString()).replace('{{', '&amp;amp;#123;&amp;amp;#123;'){{/html}}
    +    {{include reference="" author="target"/}}
     
       #end
       {{html wiki=true}}
    
  • application-blog-ui/src/main/resources/Blog/RssCode.xml+1 7 modified
    @@ -281,13 +281,7 @@
     #macro(printBlogRssItem $entryDoc)
       #set($entryUrl = $entryDoc.getExternalURL('view', "language=${entryDoc.realLocale}"))
       #getEntryObject($entryDoc $entryObj)
    -  #getEntryContent($entryDoc $entryObj true $entryContent true)
    -  #if($!entryDoc.syntax.toIdString() == 'xwiki/1.0')
    -    #set($desc = $entryContent)
    -  #else
    -    #set($desc = $services.blog.renderRSSDescription($entryContent, $entryDoc))
    -  #end
    -  #set($desc = $escapetool.xml($desc))
    +  #set($desc = $escapetool.xml($services.blog.renderContentHTML($entryDoc, $entryObj, true, true, true)))
       &lt;item rdf:about="$entryUrl"&gt;
         &lt;title&gt;$escapetool.xml($entryDoc.getValue('title'))&lt;/title&gt;
         &lt;link&gt;$entryUrl&lt;/link&gt;
    

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

5

News mentions

0

No linked articles in our index yet.