Eval Injection in XWiki Rendering XML

The xwiki-rendering-xml component is vulnerable to an evaluation injection issue (CVE-2025-53837) due to insufficient escaping of rendering output when used within HTML macros. An attacker with standard document editing permissions, such as the ability to edit their own user profile or other wiki documents, can craft malicious input that prematurely closes the HTML macro block. This enables the injection of arbitrary script macros, including Groovy and Python. Because these macros are executed with programming rights, the impact includes full, unrestricted read and write access to all wiki content and potential remote code execution on the underlying server. The vulnerability affects XWiki versions prior to 14.10.2 and 15.0 RC1. Defenders should prioritize patching to the identified versions to prevent unauthorized script execution via the rendering pipeline.

Impact

Successful exploitation grants an attacker full control over the wiki installation, including data exfiltration and administrative control via script execution. The vulnerability is highly impactful due to the broad nature of programming rights in XWiki, which effectively elevates standard user document-editing access to full system command execution capabilities within the application context.

Recommendation

• Upgrade XWiki installations utilizing xwiki-rendering-xml to version 14.10.2 or 15.0 RC1 immediately to remediate CVE-2025-53837.
• Review and audit user-created documents and profile pages for suspicious object additions, specifically looking for those utilizing the 'XWiki.UIExtensionClass'.
• Restrict document editing permissions to trusted users to reduce the potential attack surface while the upgrade is pending.