-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.xwiki.platform:xwiki-platform-vfs-ui | maven | >= 7.4-milestone-2, < 13.10.11 | 13.10.11 |
| org.xwiki.platform:xwiki-platform-vfs-ui | maven | >= 14.0-rc-1, < 14.4.8 | 14.4.8 |
| org.xwiki.platform:xwiki-platform-vfs-ui | maven | >= 14.5, < 14.10.2 | 14.10.2 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from the VFSTreeMacro's Velocity template where user-provided 'root' parameter was directly interpolated into the template without sanitization. The commit diff shows the fix adds Rendering Escape Tool ($services.rendering.escape) to both 'root' and 'reference' parameters, confirming the lack of output encoding was the vulnerability vector. The macro's code generation pattern (user input → template interpolation → macro execution) matches classic injection vulnerability patterns, and the CWE-74 classification directly maps to this unescaped output scenario.