Skip to content
OpenAdvisories
High · 7.5 Public exploit CVE-2022-24897 EUVD-2022-1713GHSA-cvx5-m8vg-vxgc

Arbitrary filesystem write access from Velocity

Published May 2, 2022 · Updated Apr 22, 2025 · Assigned by GitHub_M

Vendor: xwiki Product: xwiki-commons Package: org.xwiki.commons:xwiki-commons-velocity Ecosystem: Maven

Description

APIs to evaluate content with Velocity is a package for APIs to evaluate content with Velocity. Starting with version 2.3 and prior to 12.6.7, 12.10.3, and 13.0, the velocity scripts are not properly sandboxed against using the Java File API to perform read or write operations on the filesystem. Writing an attacking script in Velocity requires the Script rights in XWiki so not all users can use it, and it also requires finding an XWiki API which returns a File. The problem has been patched in versions 12.6.7, 12.10.3, and 13.0. There is no easy workaround for fixing this vulnerability other than upgrading and being careful when giving Script rights.

Affected products

VendorProductAffectedFixed
xwiki xwiki-commons >= 2.3, < 12.6.7, 12.7-rc-1, < 12.10.3 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.xwiki.commons:xwiki-commons-velocity >= 2.3.0, < 12.6.7 12.6.7 GHSA-cvx5-m8vg-vxgc
Maven org.xwiki.commons:xwiki-commons-velocity >= 12.7.0, < 12.10.3 12.10.3 GHSA-cvx5-m8vg-vxgc

References