CVE-2022-29253

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting with version 8.3-rc-1 and prior to versions 12.10.3 and 14.0, one can ask for any file located in the classloader using the template API and a path with ".." in it. The issue is patched in versions 14.0 and 13.10.3. There is no easy workaround for this issue.

• CWE-22
• CWE-24
• CWE-22

• https://github.com/xwiki/xwiki-platform/commit/4917c8f355717bb636d763844528b1fe0f95e8e2Patch, Third Party Advisory
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-9qrp-h7fw-42hgThird Party Advisory
• https://jira.xwiki.org/browse/XWIKI-19349Vendor Advisory
• https://github.com/xwiki/xwiki-platform/commit/4917c8f355717bb636d763844528b1fe0f95e8e2Patch, Third Party Advisory
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-9qrp-h7fw-42hgThird Party Advisory
• https://jira.xwiki.org/browse/XWIKI-19349Vendor Advisory

Published

May 25, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-29248Guzzle is a PHP HTTP client. Guzzle prior to versions 6.5.6 …8.1
• CVE-2022-29249JavaEZ is a library that adds new functions to make Java eas…7.5
• CVE-2022-2925Cross-site Scripting (XSS) - Stored in GitHub repository app…5.4
• CVE-2022-29250GLPI is a Free Asset and IT Management Software package, tha…6.5
• CVE-2022-29251XWiki Platform Flamingo Theme UI is a tool that allows custo…6.1
• CVE-2022-29252XWiki Platform Wiki UI Main Wiki is a package for managing s…6.1
• CVE-2022-29254silverstripe-omnipay is a SilverStripe integration with Omni…6.5
• CVE-2022-29255Vyper is a Pythonic Smart Contract Language for the ethereum…7.5
• CVE-2022-29256sharp is an application for Node.js image processing. Prior …6.7
• CVE-2022-29257Electron is a framework for writing cross-platform desktop a…7.2
• CVE-2022-29258XWiki Platform Filter UI provides a generic user interface t…6.1
• CVE-2022-2926The Download Manager WordPress plugin before 3.2.55 does not…4.9