CVE-2022-36097

XWiki Platform Attachment UI vulnerable to cross-site scripting in the move attachment form

8.9 HighFix available

XWiki Platform Attachment UI provides a macro to easily upload and select attachments for XWiki Platform, a generic wiki platform. Starting with version 14.0-rc-1 and prior to 14.4-rc-1, it's possible to store JavaScript in an attachment name, which will be executed by anyone trying to move the corresponding attachment. This issue has been patched in XWiki 14.4-rc-1. As a workaround, one may copy moveStep1.vm to webapp/xwiki/templates/moveStep1.vm and replace vulnerable code with code from the patch.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: Required

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: Low

Exploit likelihood

58.2%Up 57.2 points since Sep 9, 2022

What each source reports

CVE List Score used 8.9

XWiki Platform Attachment UI vulnerable to cross-site scripting in the move attachment form

Record: CVE-2022-36097
CVSS 3.1: 8.9 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L
Weakness: CWE-79, CWE-80
Updated: 2026-11-02

EUVDEUVD-2022-6764 8.9

Record: EUVD-2022-6764
CVSS 3.1: 8.9 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L
Updated: 2026-11-02

GitHub AdvisoriesGHSA-9r9j-57rf-f6vj 8.9

XWiki Platform Attachment UI vulnerable to cross-site scripting in the move attachment form

Impact

It's possible to store JavaScript in an attachment name, which will be executed by anyone trying to move the corresponding attachment.

For example, an attachment with name ><img src=1 onerror=alert(1)>.jpg will execute the alert.

Patches

This issue has been patched in XWiki 14.4RC1.

Workarounds

It is possible to fix the vulnerability by copying moveStep1.vm to webapp/xwiki/templates/moveStep1.vm and replace

#set($titleToDisplay = $services.localization.render('attachment.move.title', 
  [$attachment.name, $escapetool.xml($doc.plainTitle), $doc.getURL()]))

#set($titleToDisplay = $services.localization.render('attachment.move.title', [
  $escapetool.xml($attachment.name), 
  $escapetool.xml($doc.plainTitle), 
  $escapetool.xml($doc.getURL())
]))

See the corresponding patch.

References

https://jira.xwiki.org/browse/XWIKI-19667

For more information

If you have any questions or comments about this advisory:

Open an issue in Jira XWiki.org
Email us at Security Mailing List

Record: GHSA-9r9j-57rf-f6vj
CVSS 3.1: 8.9 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L
Weakness: CWE-79, CWE-80
Updated: 2026-11-02

NVD 8.9

Record: CVE-2022-36097
CVSS 3.1: 8.9 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L
CVSS 3.1: 6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness: CWE-79, CWE-80
Updated: 2026-11-02

OSV 8.9

XWiki Platform Attachment UI vulnerable to cross-site scripting in the move attachment form

Record: CVE-2022-36097
CVSS 3.1: 8.9 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L
Weakness: CWE-79, CWE-80
Updated: 2026-11-02

OSVGHSA-9r9j-57rf-f6vj 8.9

XWiki Platform Attachment UI vulnerable to cross-site scripting in the move attachment form

Impact

It's possible to store JavaScript in an attachment name, which will be executed by anyone trying to move the corresponding attachment.

For example, an attachment with name ><img src=1 onerror=alert(1)>.jpg will execute the alert.

Patches

This issue has been patched in XWiki 14.4RC1.

Workarounds

It is possible to fix the vulnerability by copying moveStep1.vm to webapp/xwiki/templates/moveStep1.vm and replace

#set($titleToDisplay = $services.localization.render('attachment.move.title', 
  [$attachment.name, $escapetool.xml($doc.plainTitle), $doc.getURL()]))

#set($titleToDisplay = $services.localization.render('attachment.move.title', [
  $escapetool.xml($attachment.name), 
  $escapetool.xml($doc.plainTitle), 
  $escapetool.xml($doc.getURL())
]))

See the corresponding patch.

References

https://jira.xwiki.org/browse/XWIKI-19667

For more information

If you have any questions or comments about this advisory:

Open an issue in Jira XWiki.org
Email us at Security Mailing List

Record: GHSA-9r9j-57rf-f6vj
CVSS 3.1: 8.9 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L
Weakness: CWE-79, CWE-80
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`org.xwiki.platform:xwiki-platform-attachment-ui` Maven	14.0-rc-1 up to 14.4-rc-1	14.4-rc-1

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-36097 is a high vulnerability (CVSS 8.9) in Xwiki, published September 8, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 58.2%, the 99th percentile. Fixed in org.xwiki.platform:xwiki-platform-attachment-ui 14.4-rc-1.