Description
XWiki Rendering is a generic rendering system that converts textual input in a given syntax (wiki syntax, HTML, etc) into another syntax (XHTML, etc). Starting in version 5.4.5 and prior to version 14.10, the XHTML syntax depended on the `xdom+xml/current` syntax which allows the creation of raw blocks that permit the insertion of arbitrary HTML content including JavaScript. This allows XSS attacks for users who can edit a document like their user profile (enabled by default). This has been fixed in version 14.10 by removing the dependency on the `xdom+xml/current` syntax from the XHTML syntax. Note that the `xdom+xml` syntax is still vulnerable to this attack. As it's main purpose is testing and its use is quite difficult, this syntax shouldn't be installed or used on a regular wiki. There are no known workarounds apart from upgrading.
INFO
Published Date :
2025-07-14T23:00:35.577Z
Last Modified :
2025-07-15T19:49:26.336Z
Source :
GitHub_M
AFFECTED PRODUCTS
The following products are affected by CVE-2025-53835 vulnerability.
| Vendors | Products |
|---|---|
| Xwiki |
|
REFERENCES
Here, you will find a curated list of external links that provide in-depth information to CVE-2025-53835.
