CVE-2022-36099

XWiki Platform Wiki UI Main Wiki is software for managing subwikis on XWiki Platform, a generic wiki platform. Starting with version 5.3-milestone-2 and prior to versions 13.10.6 and 14.4, it's possible to inject arbitrary wiki syntax including Groovy, Python and Velocity script macros via the request (URL parameter) using the `XWikiServerClassSheet` if the user has view access to this sheet and another page that has been saved with programming rights, a standard condition on a public read-only XWiki installation or a private XWiki installation where the user has an account. This allows arbitrary Groovy/Python/Velocity code execution which allows bypassing all rights checks and thus both modification and disclosure of all content stored in the XWiki installation. Also, this could be used to impact the availability of the wiki. This has been patched in versions 13.10.6 and 14.4. As a workaround, edit the affected document `XWiki.XWikiServerClassSheet` or `WikiManager.XWikiServerClassSheet` and manually perform the changes from the patch fixing the issue. On XWiki versions 12.0 and later, it is also possible to import the document `XWiki.XWikiServerClassSheet` from the xwiki-platform-wiki-ui-mainwiki package version 14.4 using the import feature of the administration application as there have been no other changes to this document since XWiki 12.0.

• CWE-94
• CWE-95
• CWE-116

• https://github.com/xwiki/xwiki-platform/commit/fc77f9f53bc65a4a9bfae3d5686615309c0c76ccPatch, Third Party Advisory
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-xr6m-2p4m-jvqfExploit, Third Party Advisory
• https://jira.xwiki.org/browse/XWIKI-19746Vendor Advisory
• https://github.com/xwiki/xwiki-platform/commit/fc77f9f53bc65a4a9bfae3d5686615309c0c76ccPatch, Third Party Advisory
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-xr6m-2p4m-jvqfExploit, Third Party Advisory
• https://jira.xwiki.org/browse/XWIKI-19746Vendor Advisory

Published

Sep 8, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-36093XWiki Platform Web Templates are templates for XWiki Platfor…7.1
• CVE-2022-36094XWiki Platform Web Parent POM contains Web resources for the…9
• CVE-2022-36095XWiki Platform is a generic wiki platform. Prior to versions…4.3
• CVE-2022-36096The XWiki Platform Index UI is an Index of all pages, attach…9
• CVE-2022-36097XWiki Platform Attachment UI provides a macro to easily uplo…6.1
• CVE-2022-36098XWiki Platform Mentions UI is a user interface for mentionin…9
• CVE-2022-3610The Jeeng Push Notifications WordPress plugin before 2.0.4 d…4.8
• CVE-2022-36100XWiki Platform Applications Tag and XWiki Platform Tag UI ar…8.8
• CVE-2022-36101Shopware is an open source e-commerce software. In affected …5.3
• CVE-2022-36102Shopware is an open source e-commerce software. In affected …7.2
• CVE-2022-36103Talos Linux is a Linux distribution built for Kubernetes dep…8.8
• CVE-2022-36104TYPO3 is an open source PHP based web content management sys…7.5