-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from improper escaping in the Velocity template when generating the 'Cancel' button's link. The original code used raw $targetDocument and localization strings without escaping, allowing attackers to inject code via the docname parameter. The patch explicitly adds double escaping for both the localization string and document reference, confirming the vulnerable code path was in the template's link generation logic. The added test case in AttachmentSelectorPageTest.java verifies the escaping mechanism, further validating this as the root cause.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.xwiki.platform:xwiki-platform-attachment-ui | maven | >= 2.0-rc-2, < 13.10.11 | 13.10.11 |
| org.xwiki.platform:xwiki-platform-attachment-ui | maven | >= 14.0-rc-1, < 14.4.8 | 14.4.8 |
| org.xwiki.platform:xwiki-platform-attachment-ui | maven | >= 14.5, < 14.10.1 | 14.10.1 |
A Semantic Attack on Google Gemini - Read the Latest Research