CVE-2024-37900

Deeper analysis

XWiki Platform, a generic wiki platform, is affected by a client-side code injection vulnerability (CWE-94, CWE-96) that triggers when a user uploads an attachment whose filename contains malicious JavaScript. The flaw allows the injected script to execute in the browser during the upload process itself, with a CVSS 3.1 score of 6.4 reflecting the combination of network attack vector, high attack complexity, and required user interaction.

An attacker must first perform social engineering to convince a victim who possesses upload rights to submit a file with a crafted name. Successful exploitation runs arbitrary JavaScript solely in the context of the uploading user, enabling actions such as modifying content or performing privileged operations on that user’s behalf; the malicious filename is visible to the victim, limiting the practicality of the attack.

The vulnerability has been fixed in XWiki releases 14.10.21, 15.5.5, 15.10.6, and 16.0.0, as documented in the project’s GitHub security advisory and the associated code commits that sanitize attachment filenames before processing. The EPSS score remains flat at 0.0533 with no observed increase after disclosure.