PT-2025-29524 · Xwiki · Xwiki

René De Sain + 1 · Published 2025-07-14 · Updated 2025-07-29 · CVE-2025-53836

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: XWiki versions 4.2-milestone-1 through 13.10.10 XWiki versions 14.4.0 through 14.4.6 XWiki versions 14.10.0 through 14.9.9

Description: XWiki Rendering is a system that converts textual input into different syntaxes. A flaw exists where the default macro content parser does not properly enforce restrictions when executing nested macros. This allows the execution of macros normally prohibited in restricted mode, specifically script macros. The cache and chart macros included with XWiki are affected by this issue.

Recommendations: XWiki versions 4.2-milestone-1 through 13.10.10: Upgrade to version 13.10.11 or later. XWiki versions 14.4.0 through 14.4.6: Upgrade to version 14.4.7 or later. XWiki versions 14.10.0 through 14.9.9: Upgrade to version 14.10 or later. As a temporary measure, disable comments for untrusted users.

Exploit

Fix

RCE

Incorrect Authorization

Code Injection

Weakness Enumeration

CWE-863

CWE-94

CWE-270

Related Identifiers

BDU:2025-12739

CVE-2025-53836

GHSA-32MF-57H2-64X9

Affected Products

Xwiki

References · 18

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/53xxx/CVE-2025-53836.json · Exploit
• 🔥 https://github.com/xwiki/xwiki-rendering/security/advisories/GHSA-32mf-57h2-64x9 · Exploit
• 🔥 https://jira.xwiki.org/browse/XRENDERING-689 · Exploit
• 🔥 https://jira.xwiki.org/browse/XWIKI-20375 · Exploit
• https://github.com/xwiki/xwiki-rendering/commit/c73fa3ccd4ac59057e48e5d4325f659e78e8f86d · Patch
• https://bdu.fstec.ru/vul/2025-12739 · Security Note
• https://osv.dev/vulnerability/CVE-2025-53836 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-32mf-57h2-64x9 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-53836 · Security Note
• https://github.com/xwiki/xwiki-rendering · Note
• https://twitter.com/vulert_official/status/1945374201818292621 · Twitter Post
• https://twitter.com/cracbot/status/1946887848906588219 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1944959457315700863 · Twitter Post
• https://twitter.com/CVEnew/status/1944903205235851748 · Twitter Post
• https://twitter.com/jmdevlabs/status/1950007993078075409 · Twitter Post