CVE-2024-31981

XWiki Platform is a generic wiki platform. Starting in version 3.0.1 and prior to versions 4.10.20, 15.5.4, and 15.10-rc-1, remote code execution is possible via PDF export templates. This vulnerability has been patched in XWiki 14.10.20, 15.5.4 and 15.10-rc-1. If PDF templates are not typically used on the instance, an administrator can create the document `XWiki.PDFClass` and block its edition, after making sure that it does not contain a `style` attribute. Otherwise, there are no known workarounds aside from upgrading.

• CWE-862
• CWE-862

• https://github.com/xwiki/xwiki-platform/commit/480186f9d2fca880513da8bc5a609674d106cbd3Patch
• https://github.com/xwiki/xwiki-platform/commit/a4ad14d9c1605a5ab957237e505ebbb29f5b9d73Patch
• https://github.com/xwiki/xwiki-platform/commit/d28e21a670c69880b951e415dd2ddd69d273eae9Patch
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-vxwr-wpjv-qjq7Vendor Advisory
• https://jira.xwiki.org/browse/XWIKI-21337Exploit, Vendor Advisory
• https://github.com/xwiki/xwiki-platform/commit/480186f9d2fca880513da8bc5a609674d106cbd3Patch
• https://github.com/xwiki/xwiki-platform/commit/a4ad14d9c1605a5ab957237e505ebbb29f5b9d73Patch
• https://github.com/xwiki/xwiki-platform/commit/d28e21a670c69880b951e415dd2ddd69d273eae9Patch
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-vxwr-wpjv-qjq7Vendor Advisory
• https://jira.xwiki.org/browse/XWIKI-21337Exploit, Vendor Advisory

Published

Apr 10, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-31976EnGenius EWS356-FIR 1.1.30 and earlier devices allow a remot…8
• CVE-2024-31977Adtran 834-5 11.1.0.101-202106231430, and fixed as of SmartO…8.8
• CVE-2024-31978A vulnerability has been identified in SINEC NMS (All versio…7.6
• CVE-2024-31979Server-Side Request Forgery (SSRF) vulnerability in Apache S…4.3
• CVE-2024-3198The WP Font Awesome Share Icons plugin for WordPress is vuln…6.4
• CVE-2024-31980A vulnerability has been identified in Parasolid V35.1 (All …7.8
• CVE-2024-31982XWiki Platform is a generic wiki platform. Starting in versi…9.8
• CVE-2024-31983XWiki Platform is a generic wiki platform. In multilingual w…8.8
• CVE-2024-31984XWiki Platform is a generic wiki platform. Starting in versi…8.8
• CVE-2024-31985XWiki Platform is a generic wiki platform. Starting in versi…5.4
• CVE-2024-31986XWiki Platform is a generic wiki platform. Starting in versi…8.8
• CVE-2024-31987XWiki Platform is a generic wiki platform. Starting in versi…8.8