CVE-2021-43841

XWiki is a generic wiki platform offering runtime services for applications built on top of it. When using default XWiki configuration, it's possible for an attacker to upload an SVG containing a script executed when executing the download action on the file. This problem has been patched so that the default configuration doesn't allow to display the SVG files in the browser. Users are advised to update or to disallow uploads of SVG files.

• CWE-79
• CWE-79

• https://github.com/xwiki/xwiki-platform/commit/5853d492b3a274db0d94d560e2a5ea988a271c62Patch, Third Party Advisory
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-9jq9-c2cv-pcrjThird Party Advisory
• https://jira.xwiki.org/browse/XWIKI-18368Exploit, Patch, Vendor Advisory
• https://www.xwiki.org/xwiki/bin/view/Documentation/AdminGuide/Attachments#HAttachmentdisplayordownloadVendor Advisory
• https://github.com/xwiki/xwiki-platform/commit/5853d492b3a274db0d94d560e2a5ea988a271c62Patch, Third Party Advisory
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-9jq9-c2cv-pcrjThird Party Advisory
• https://jira.xwiki.org/browse/XWIKI-18368Exploit, Patch, Vendor Advisory
• https://www.xwiki.org/xwiki/bin/view/Documentation/AdminGuide/Attachments#HAttachmentdisplayordownloadVendor Advisory

Published

Feb 4, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-43836Sulu is an open-source PHP content management system based o…8.8
• CVE-2021-43837vault-cli is a configurable command-line interface tool (and…9.1
• CVE-2021-43838jsx-slack is a library for building JSON objects for Slack B…7.5
• CVE-2021-43839Cronos is a commercial implementation of a blockchain. In Cr…7.5
• CVE-2021-4384The WordPress Photo Gallery – Image Gallery plugin for WordP…4.3
• CVE-2021-43840message_bus is a messaging bus for Ruby processes and web cl…6.5
• CVE-2021-43842Wiki.js is a wiki app built on Node.js. Wiki.js versions 2.5…5.4
• CVE-2021-43843jsx-slack is a package for building JSON objects for Slack b…7.5
• CVE-2021-43844MSEdgeRedirect is a tool to redirect news, search, widgets, …8.8
• CVE-2021-43845PJSIP is a free and open source multimedia communication lib…9.1
• CVE-2021-43846`solidus_frontend` is the cart and storefront for the Solidu…4.3
• CVE-2021-43847HumHub is an open-source social network kit written in PHP. …6.5