CVE-2022-36096
XWiki Platform vulnerable to Cross-site Scripting in the deleted attachments list
The XWiki Platform Index UI is an Index of all pages, attachments, orphans and deleted pages and attachments for XWiki Platform, a generic wiki platform. Prior to versions 13.10.6 and 14.3, it's possible to store JavaScript which will be executed by anyone viewing the deleted attachments index with an attachment containing javascript in its name. This issue has been patched in XWiki 13.10.6 and 14.3. As a workaround, modify fix the vulnerability by editing the wiki page XWiki.DeletedAttachments with the object editor, open the JavaScriptExtension object and apply on the content the changes that can be found on the fix commit.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
XWiki Platform vulnerable to Cross-site Scripting in the deleted attachments list
The XWiki Platform Index UI is an Index of all pages, attachments, orphans and deleted pages and attachments for XWiki Platform, a generic wiki platform. Prior to versions 13.10.6 and 14.3, it's possible to store JavaScript which will be executed by anyone viewing the deleted attachments index with an attachment containing javascript in its name. This issue has been patched in XWiki 13.10.6 and 14.3. As a workaround, modify fix the vulnerability by editing the wiki page XWiki.DeletedAttachments with the object editor, open the JavaScriptExtension object and apply on the content the changes that can be found on the fix commit.
- Record
CVE-2022-36096- CVSS 3.1
- 8.9 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L - Weakness
- CWE-79, CWE-80
- Updated
- 2026-11-02
EUVDEUVD-2022-6824
The XWiki Platform Index UI is an Index of all pages, attachments, orphans and deleted pages and attachments for XWiki Platform, a generic wiki platform. Prior to versions 13.10.6 and 14.3, it's possible to store JavaScript which will be executed by anyone viewing the deleted attachments index with an attachment containing javascript in its name. This issue has been patched in XWiki 13.10.6 and 14.3. As a workaround, modify fix the vulnerability by editing the wiki page XWiki.DeletedAttachments with the object editor, open the JavaScriptExtension object and apply on the content the changes that can be found on the fix commit.
- Record
EUVD-2022-6824- CVSS 3.1
- 8.9 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-gjmq-x5x7-wc36
XWiki Platform vulnerable to Cross-site Scripting in the deleted attachments list
Impact
It's possible to store a JavaScript which will be executed by anyone viewing the deleted attachments index with an attachment containing javascript in its name.
For example, attachment a file with name ><img src=1 onerror=alert(1)>.jpg will execute the alert.
Patches
This issue has been patched in XWiki 13.10.6 and 14.3.
Workarounds
It is possible to modify fix the vulnerability by editing the wiki page XWiki.DeletedAttachments with the object editor, open the JavaScriptExtension object and apply on the content the changes that can be found on the commit https://github.com/xwiki/xwiki-platform/commit/6705b0cd0289d1c90ed354bd4ecc1508c4b25745.
References
For more information
If you have any questions or comments about this advisory:
- Open an issue in Jira XWiki.org
- Email us at Security Mailing List
- Record
GHSA-gjmq-x5x7-wc36- CVSS 3.1
- 8.9 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L - Weakness
- CWE-79, CWE-80
- Updated
- 2026-11-02
NVD
The XWiki Platform Index UI is an Index of all pages, attachments, orphans and deleted pages and attachments for XWiki Platform, a generic wiki platform. Prior to versions 13.10.6 and 14.3, it's possible to store JavaScript which will be executed by anyone viewing the deleted attachments index with an attachment containing javascript in its name. This issue has been patched in XWiki 13.10.6 and 14.3. As a workaround, modify fix the vulnerability by editing the wiki page XWiki.DeletedAttachments with the object editor, open the JavaScriptExtension object and apply on the content the changes that can be found on the fix commit.
- Record
CVE-2022-36096- CVSS 3.1
- 8.9 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L - CVSS 3.1
- 9.0 Critical
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H - Weakness
- CWE-79, CWE-80
- Updated
- 2026-11-02
OSV
XWiki Platform vulnerable to Cross-site Scripting in the deleted attachments list
The XWiki Platform Index UI is an Index of all pages, attachments, orphans and deleted pages and attachments for XWiki Platform, a generic wiki platform. Prior to versions 13.10.6 and 14.3, it's possible to store JavaScript which will be executed by anyone viewing the deleted attachments index with an attachment containing javascript in its name. This issue has been patched in XWiki 13.10.6 and 14.3. As a workaround, modify fix the vulnerability by editing the wiki page XWiki.DeletedAttachments with the object editor, open the JavaScriptExtension object and apply on the content the changes that can be found on the fix commit.
- Record
CVE-2022-36096- CVSS 3.1
- 8.9 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L - Weakness
- CWE-79, CWE-80
- Updated
- 2026-11-02
OSVGHSA-gjmq-x5x7-wc36
XWiki Platform vulnerable to Cross-site Scripting in the deleted attachments list
Impact
It's possible to store a JavaScript which will be executed by anyone viewing the deleted attachments index with an attachment containing javascript in its name.
For example, attachment a file with name ><img src=1 onerror=alert(1)>.jpg will execute the alert.
Patches
This issue has been patched in XWiki 13.10.6 and 14.3.
Workarounds
It is possible to modify fix the vulnerability by editing the wiki page XWiki.DeletedAttachments with the object editor, open the JavaScriptExtension object and apply on the content the changes that can be found on the commit https://github.com/xwiki/xwiki-platform/commit/6705b0cd0289d1c90ed354bd4ecc1508c4b25745.
References
For more information
If you have any questions or comments about this advisory:
- Open an issue in Jira XWiki.org
- Email us at Security Mailing List
- Record
GHSA-gjmq-x5x7-wc36- CVSS 3.1
- 8.9 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L - Weakness
- CWE-79, CWE-80
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.xwiki.platform:xwiki-platform-index-uiMaven |
2.2-milestone-1 up to 13.10.6 | 13.10.6 |
org.xwiki.platform:xwiki-platform-index-uiMaven |
14.0 up to 14.3 | 14.3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-36096 is a high vulnerability (CVSS 8.9) in Xwiki, published September 8, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 60.2%, the 99th percentile. Fixed in org.xwiki.platform:xwiki-platform-index-ui 13.10.6.
References
github.com/xwiki/xwiki-platform/security/advisories/GHSA-gjmq-x5x7-wc36
jira.xwiki.org/browse/XWIKI-19613
nvd.nist.gov/vuln/detail/CVE-2022-36096