CVE-2025-32430

Name of the Vulnerable Software and Affected Versions XWiki Platform versions 4.2-milestone-3 through 16.4.7 XWiki Platform versions 16.5.0-rc-1 through 16.10.5 XWiki Platform versions 17.0.0-rc-1 through 17.2.2

Description The platform contains reflected cross-site scripting (XSS) vulnerabilities in two templates. An attacker can execute malicious JavaScript code in the context of a victim's session by getting the victim to visit a crafted URL. This allows the attacker to perform actions using the victim's permissions. The issue is exploitable through URLs such as /xwiki/bin/view/Main/?xpage=job status json&jobId=asdf&translationPrefix=<img src=1 onerror=alert(document.domain)> and /xwiki/bin/view/Main/?xpage=distribution&extensionId=%3Cimg src=x onerror=alert(document.domain)%3E&extensionVersionConstraint=%3Cimg src=x onerror=alert(document.domain)%3E.

Recommendations XWiki Platform versions prior to 16.4.8 XWiki Platform versions prior to 16.10.6 XWiki Platform versions prior to 17.3.0-rc-1 Manually patch the WAR file with the changes included in the original patch.