CVE-2025-53835

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-53835
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-53835.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-53835
Aliases
Published
2025-07-14T23:00:35.577Z
Modified
2026-07-15T02:15:39.463237194Z
Severity
  • 9.0 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H CVSS Calculator
Summary
XWiki Rendering is vulnerable to XSS attacks through insecure XHTML syntax
Details

XWiki Rendering is a generic rendering system that converts textual input in a given syntax (wiki syntax, HTML, etc) into another syntax (XHTML, etc). Starting in version 5.4.5 and prior to version 14.10, the XHTML syntax depended on the xdom+xml/current syntax which allows the creation of raw blocks that permit the insertion of arbitrary HTML content including JavaScript. This allows XSS attacks for users who can edit a document like their user profile (enabled by default). This has been fixed in version 14.10 by removing the dependency on the xdom+xml/current syntax from the XHTML syntax. Note that the xdom+xml syntax is still vulnerable to this attack. As it's main purpose is testing and its use is quite difficult, this syntax shouldn't be installed or used on a regular wiki. There are no known workarounds apart from upgrading.

Database specific 
{
    "cwe_ids": [
        "CWE-79",
        "CWE-80"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/53xxx/CVE-2025-53835.json",
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/xwiki/xwiki-commons

Affected ranges

Type
GIT
Repo
https://github.com/xwiki/xwiki-commons
Events
Introduced
6c03713c852a1fe73466c6001f0c70b03637a577
Fixed
719ede2f8510fa69498761659de8d65eec5817db
Database specific 
{
    "cpe": "cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "5.4.5"
        },
        {
            "fixed": "14.10"
        }
    ],
    "source": "CPE_RANGE"
}
Type
GIT
Repo
https://github.com/xwiki/xwiki-platform
Events
Introduced
7624af4939a46405cdfb3ad53e3bef7fc31b615d
Fixed
c524887d154ff8f6df9651e36b904e234bf5a6ef
Database specific 
{
    "cpe": "cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "5.4.5"
        },
        {
            "fixed": "14.10"
        }
    ],
    "source": "CPE_RANGE"
}
Type
GIT
Repo
https://github.com/xwiki/xwiki-rendering
Events
Introduced
f4cbc74736522adb1ab4f0e5e6e108a302a993aa
Fixed
a4ca31f99f524b9456c64150d6f375984aa81ea7
Database specific 
{
    "extracted_events": [
        {
            "introduced": "5.4.5"
        },
        {
            "fixed": "14.10"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-53835.json"