CVE-2021-43841
XSS by SVG upload in xwiki-platform
XWiki is a generic wiki platform offering runtime services for applications built on top of it. When using default XWiki configuration, it's possible for an attacker to upload an SVG containing a script executed when executing the download action on the file. This problem has been patched so that the default configuration doesn't allow to display the SVG files in the browser. Users are advised to update or to disallow uploads of SVG files.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
XSS by SVG upload in xwiki-platform
XWiki is a generic wiki platform offering runtime services for applications built on top of it. When using default XWiki configuration, it's possible for an attacker to upload an SVG containing a script executed when executing the download action on the file. This problem has been patched so that the default configuration doesn't allow to display the SVG files in the browser. Users are advised to update or to disallow uploads of SVG files.
- Record
CVE-2021-43841- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
EUVDEUVD-2022-0941
XWiki is a generic wiki platform offering runtime services for applications built on top of it. When using default XWiki configuration, it's possible for an attacker to upload an SVG containing a script executed when executing the download action on the file. This problem has been patched so that the default configuration doesn't allow to display the SVG files in the browser. Users are advised to update or to disallow uploads of SVG files.
- Record
EUVD-2022-0941- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-9jq9-c2cv-pcrj
Cross-site Scripting by SVG upload in xwiki-platform
Impact
When using default XWiki configuration, it's possible for an attacker to upload an SVG containing a script executed when executing the download action on the file.
Patches
This problem has been patched so that the default configuration doesn't allow to display the SVG files in the browser.
Workarounds
This issue can be fixed without the patch by setting properly the configuration to download or display files, see: https://www.xwiki.org/xwiki/bin/view/Documentation/AdminGuide/Attachments#HAttachmentdisplayordownload
References
https://jira.xwiki.org/browse/XWIKI-18368
For more information
If you have any questions or comments about this advisory:
- Open an issue in Jira
- Email us at security ML
- Record
GHSA-9jq9-c2cv-pcrj- CVSS 3.1
- 4.1 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
NVD
XWiki is a generic wiki platform offering runtime services for applications built on top of it. When using default XWiki configuration, it's possible for an attacker to upload an SVG containing a script executed when executing the download action on the file. This problem has been patched so that the default configuration doesn't allow to display the SVG files in the browser. Users are advised to update or to disallow uploads of SVG files.
- Record
CVE-2021-43841- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - CVSS 2.0
- 3.5 Low
AV:N/AC:M/Au:S/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
XWiki is a generic wiki platform offering runtime services for applications built on top of it. When using default XWiki configuration, it's possible for an attacker to upload an SVG containing a script executed when executing the download action on the file. This problem has been patched so that the default configuration doesn't allow to display the SVG files in the browser. Users are advised to update or to disallow uploads of SVG files.
- Record
CVE-2021-43841- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVGHSA-9jq9-c2cv-pcrj
Cross-site Scripting by SVG upload in xwiki-platform
Impact
When using default XWiki configuration, it's possible for an attacker to upload an SVG containing a script executed when executing the download action on the file.
Patches
This problem has been patched so that the default configuration doesn't allow to display the SVG files in the browser.
Workarounds
This issue can be fixed without the patch by setting properly the configuration to download or display files, see: https://www.xwiki.org/xwiki/bin/view/Documentation/AdminGuide/Attachments#HAttachmentdisplayordownload
References
https://jira.xwiki.org/browse/XWIKI-18368
For more information
If you have any questions or comments about this advisory:
- Open an issue in Jira
- Email us at security ML
- Record
GHSA-9jq9-c2cv-pcrj- CVSS 3.1
- 4.1 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.xwiki.platform:xwiki-platform-oldcoreMaven |
before 12.10.6 | 12.10.6 |
org.xwiki.platform:xwiki-platform-oldcoreMaven |
13.0 to 13.2 | 13.3RC1 |
org.xwiki.platform:xwiki-platform-tool-configuration-resourcesMaven |
13.0 to 13.2 | 13.3RC1 |
org.xwiki.platform:xwiki-platform-tool-configuration-resourcesMaven |
before 12.10.6 | 12.10.6 |
org.xwiki.platform:xwiki-platform-oldcoreMaven |
13.0 up to 13.3RC1 | 13.3RC1 |
org.xwiki.platform:xwiki-platform-tool-configuration-resourcesMaven |
13.0 up to 13.3RC1 | 13.3RC1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-43841 is a medium vulnerability (CVSS 5.4) in Xwiki, published February 4, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.87%, the 59th percentile. Fixed in org.xwiki.platform:xwiki-platform-oldcore 12.10.6.
References
github.com/xwiki/xwiki-platform/security/advisories/GHSA-9jq9-c2cv-pcrj
jira.xwiki.org/browse/XWIKI-18368
xwiki.org/xwiki/bin/view/Documentation/AdminGuide/Attachments
nvd.nist.gov/vuln/detail/CVE-2021-43841