Xwiki Commons vulnerabilities

• xwiki xwiki-commons XWiki Platform: Path traversal via resources parameter in ssx and jsx endpoints when using leading slash CVE-2026-23734 Fix available EPSS 18.5% 9.3 CriticalMay 20, 2026
• xwiki commons, xwiki, xwiki xwiki-commons +2 more XWiki Commons missing escaping of `{` in Velocity escapetool allows remote code execution CVE-2024-31996 Fix available 10.0 CriticalApril 10, 2024
• xwiki commons, xwiki-commons +1 more HTML sanitizer allows form elements in restricted in org.xwiki.commons:xwiki-commons-xml CVE-2023-36471 Public exploitFix available 9.1 CriticalJune 29, 2023
• xwiki, xwiki xwiki-commons +1 more Improper Neutralization of Invalid Characters in Data Attribute Names in org.xwiki.commons:xwiki-commons-xml CVE-2023-31126 Public exploitFix available 9.1 CriticalMay 9, 2023
• xwiki commons, xwiki-commons +1 more Cross-site Scripting in org.xwiki.commons:xwiki-commons-xml CVE-2023-29528 Public exploitFix available 9.1 CriticalApril 20, 2023
• xwiki, xwiki xwiki-commons +1 more org.xwiki.commons:xwiki-commons-xml Cross-site Scripting vulnerability CVE-2023-29201 Public exploitFix available 9.1 CriticalApril 12, 2023
• xwiki commons, xwiki-commons +1 more XWiki Commons may allow privilege escalation to programming rights via user's first name CVE-2023-26055 Fix available 10.0 CriticalMarch 2, 2023
• xwiki, xwiki xwiki-commons +1 more Arbitrary filesystem write access from Velocity CVE-2022-24897 Public exploitFix available 7.5 HighApril 28, 2022
• xwiki commons, xwiki-commons +1 more Arbitrary file access through XML parsing in org.xwiki.commons:xwiki-commons-xml CVE-2022-24898 Fix available 4.9 MediumApril 28, 2022