CVE-2024-31996
Published: 10 April 2024
Summary
CVE-2024-31996 is a critical-severity Eval Injection (CWE-95) vulnerability in Xwiki Xwiki. Its CVSS base score is 10.0 (Critical).
Operationally, ranked in the top 7.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
XWiki Platform versions starting from 3.0.1 and prior to 14.10.19, 15.5.4, and 15.10-rc-1 contain an incomplete HTML escaping implementation in the escaping tool. The tool fails to escape the "{" character, which permits XWiki syntax injection when the output of $escapetool.html is rendered in certain contexts, ultimately enabling remote code execution. The affected component is the core escaping utility used throughout wiki documents and extensions.
An unauthenticated remote attacker can supply crafted input that reaches the vulnerable escaping call in exposed documents or extensions, achieving arbitrary code execution with the privileges of the XWiki application server. The CVSS 10.0 score reflects the absence of authentication, user interaction, or network restrictions combined with full confidentiality, integrity, and availability impact.
Advisories and patches recommend immediate upgrade to 14.10.19, 15.5.5, or 15.9 RC1. Where upgrades are not feasible, the specific workaround is to replace $escapetool.html with $escapetool.xml in affected documents; the maintainers identify Panels.PanelLayoutUpdate as one such document that must be patched, noting that other extensions may require similar changes.
The EPSS score rose from a low baseline to a peak of 0.1837 on 2025-12-11 before receding to the current value of 0.0805, indicating that exploitation interest increased after public disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-1213
Vulnerability details
XWiki Platform is a generic wiki platform. Starting in version 3.0.1 and prior to versions 4.10.19, 15.5.4, and 15.10-rc-1, the HTML escaping of escaping tool that is used in XWiki doesn't escape `{`, which, when used in certain places, allows…
more
XWiki syntax injection and thereby remote code execution. The vulnerability has been fixed in XWiki 14.10.19, 15.5.5, and 15.9 RC1. Apart from upgrading, there is no generic workaround. However, replacing `$escapetool.html` by `$escapetool.xml` in XWiki documents fixes the vulnerability. In a standard XWiki installation, the maintainers are only aware of the document `Panels.PanelLayoutUpdate` that exposes this vulnerability, patching this document is thus a workaround. Any extension could expose this vulnerability and might thus require patching, too.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Makes persistent code injection into loaded programs impossible when the executable image itself resides on hardware-protected read-only media.
Dynamically generated code can be produced and executed inside the isolated chamber, preventing host compromise from code-injection payloads.
Validates inputs used in dynamic code generation to block injected directives.
Directly prevents execution of attacker-supplied code written into data memory regions.