SB2026050581 - Multiple vulnerabilities in XWiki platform

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026050581

SB2026050581 - Multiple vulnerabilities in XWiki platform

Published: May 5, 2026

Security Bulletin ID SB2026050581
CSH Severity
High
Patch available
YES
Number of vulnerabilities 4
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 50% Medium 25% Low 25%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 4 vulnerabilities.


1) Cross-site scripting (CVE-ID: CVE-2025-32430)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to execute malicious JavaScript code in the context of the victim's session.

The vulnerability exists due to cross-site scripting in two web templates when handling attacker-controlled URL parameters. A remote attacker can send a specially crafted URL to execute malicious JavaScript code in the context of the victim's session.

User interaction is required to visit an attacker-controlled URL, which can allow arbitrary actions using the permissions of the victim.


2) Improper Removal of Sensitive Information Before Storage or Transfer (CVE-ID: CVE-2025-58049)

CWE-ID: CWE-212 - Improper Removal of Sensitive Information Before Storage or Transfer

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to improper removal of sensitive information before storage or transfer in the PDF export job status serialization when processing a PDF export request in a background job. A remote privileged user can trigger a PDF export to disclose sensitive information.

The stored job status can include user cookies, including encrypted credentials, and the encryption key is stored in the same data directory by default.


3) Relative Path Traversal (CVE-ID: CVE-2025-55748)

CWE-ID: CWE-23 - Relative Path Traversal

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to path traversal in the jsx and sx endpoints when handling resource parameters in requests. A remote attacker can send a specially crafted request to disclose sensitive information.

This can be reproduced on Tomcat instances.


4) Relative Path Traversal (CVE-ID: CVE-2025-55747)

CWE-ID: CWE-23 - Relative Path Traversal

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to relative path traversal in the webjars API when handling crafted webjars URLs with encoded path separators. A remote attacker can send a specially crafted request to disclose sensitive information.

Configuration files can be accessed through traversal outside the intended directory.


Remediation

Install update from vendor's website.

References