CVE-2025-53835: fallo crítico en xwiki-rendering
XWiki Rendering is vulnerable to XSS attacks through insecure XHTML syntax
Publicada el · Actualizada el
Seguir esta CVE+ Monitorear xwiki-rendering+ Monitorear org.xwiki.rendering:xwiki-rendering-syntax-xhtml
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
28Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 9.1epss 0.4%
XWiki Rendering is a generic rendering system that converts textual input in a given syntax (wiki syntax, HTML, etc) into another syntax (XHTML, etc). Starting in version 5.4.5 and prior to version 14.10, the XHTML syntax depended on the `xdom+xml/current` syntax which allows the creation of raw blocks that permit the insertion of arbitrary HTML content including JavaScript. This allows XSS attacks for users who can edit a document like their user profile (enabled by default). This has been fixed in version 14.10 by removing the dependency on the `xdom+xml/current` syntax from the XHTML syntax. Note that the `xdom+xml` syntax is still vulnerable to this attack. As it's main purpose is testing and its use is quite difficult, this syntax shouldn't be installed or used on a regular wiki. There are no known workarounds apart from upgrading.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Productos afectados
xwiki · xwiki-renderingCVEs relacionadas — xwiki-rendering
En el mismo producto, de las más peligrosas a las menos.
CVE-2025-53837CRITICALorg.xwiki.rendering:xwiki-rendering-xml has an Eval Injection issueEPSS 1.5%CVE-2023-37912CRITICALXWiki Rendering's footnote macro vulnerable to privilege escalation via the footnote macroEPSS 1.5%CVE-2023-37908CRITICALorg.xwiki.rendering:xwiki-rendering-xml Improper Neutralization of Invalid Characters in Identifiers in Web Pages vulnerabilityEPSS 1.1%CVE-2025-66474HIGHXWiki vulnerable to remote code execution through insufficient protection against {{/html}} injectionEPSS 1.0%CVE-2023-32070CRITICALImproper Neutralization of Script in Attributes in XWiki (X)HTML renderersEPSS 0.7%CVE-2025-53836CRITICALXWiki Rendering is vulnerable to RCE attacks when processing nested macrosEPSS 0.6%