GHSA-gwj6-xpfg-pxwr

Suggest an improvement
Source
https://github.com/advisories/GHSA-gwj6-xpfg-pxwr
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/09/GHSA-gwj6-xpfg-pxwr/GHSA-gwj6-xpfg-pxwr.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-gwj6-xpfg-pxwr
Aliases
Published
2025-09-08T20:59:47Z
Modified
2025-09-10T21:05:21Z
Severity
  • 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
XWiki Blog Application: Privilege Escalation (PR) from account through blog content
Details

Impact

The blog application in XWiki allowed remote code execution for any user who has edit right on any page. Normally, these are all logged-in users as they can edit their own user profile. To exploit, it is sufficient to add an object of type Blog.BlogPostClass to any page and to add some script macro with the exploit code to the "Content" field of that object.

Patches

The vulnerability has been patched in the blog application version 9.14 by executing the content of blog posts with the rights of the appropriate author.

Workarounds

We're not aware of any workarounds.

Resources

  • https://jira.xwiki.org/browse/BLOG-191
  • https://github.com/xwiki-contrib/application-blog/commit/b98ab6f17da3029576f42d12b4442cd555c7e0b4
Database specific 
{
    "cwe_ids": [
        "CWE-250",
        "CWE-94",
        "CWE-95"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-09-08T20:59:47Z",
    "nvd_published_at": "2025-09-08T22:15:34Z",
    "severity": "HIGH"
}
References

Affected packages

Maven / org.xwiki.contrib.blog:application-blog-ui

Package

Name
org.xwiki.contrib.blog:application-blog-ui
View open source insights on deps.dev
Purl
pkg:maven/org.xwiki.contrib.blog/application-blog-ui

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
9.14

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/09/GHSA-gwj6-xpfg-pxwr/GHSA-gwj6-xpfg-pxwr.json"