Skip to content
OpenAdvisories

Product · xwiki

xwiki-commons

9 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • High 7.5
    CVE-2022-24897 Public exploit

    Arbitrary filesystem write access from Velocity

    APIs to evaluate content with Velocity is a package for APIs to evaluate content with Velocity. Starting with version 2.3 and prior to 12.6.7, 12.10.3, and 13.0, the velocity scripts are not properly sandboxed against using the Java File API to perform read o…

    xwiki xwiki-commons org.xwiki.commons:xwiki-commons-velocity Maven