CVE-2024-37900

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. When uploading an attachment with a malicious filename, malicious JavaScript code could be executed. This requires a social engineering attack to get the victim into uploading a file with a malicious name. The malicious code is solely executed during the upload and affects only the user uploading the attachment. While this allows performing actions in the name of that user, it seems unlikely that a user wouldn't notice the malicious filename while uploading the attachment. This has been patched in XWiki 14.10.21, 15.5.5, 15.10.6 and 16.0.0.

• CWE-96
• CWE-94

• https://github.com/xwiki/xwiki-platform/commit/6cdd69d31d6bf3caa7f40ec55eb317e4e528ad28Patch
• https://github.com/xwiki/xwiki-platform/commit/8b8a2d80529b9a9c038014c1eb6c2adc08069dfdPatch
• https://github.com/xwiki/xwiki-platform/commit/910a5018a50039e8b24556573dfe342f143ef949Patch
• https://github.com/xwiki/xwiki-platform/commit/9df46f8e5313af46f93bccd1ebc682e28126573fPatch
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-wf3x-jccf-5g5gVendor Advisory
• https://jira.xwiki.org/browse/XWIKI-19602Exploit, Issue Tracking
• https://jira.xwiki.org/browse/XWIKI-19611Exploit, Issue Tracking
• https://jira.xwiki.org/browse/XWIKI-21769Exploit, Issue Tracking

Published

Jul 31, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-37895Lobe Chat is an open-source LLMs/AI chat framework. In affec…5.7
• CVE-2024-37896Gin-vue-admin is a backstage management system based on vue …8.8
• CVE-2024-37897SFTPGo is a full-featured and highly configurable SFTP, HTTP…5.4
• CVE-2024-37898XWiki Platform is a generic wiki platform offering runtime s…4.3
• CVE-2024-37899XWiki Platform is a generic wiki platform offering runtime s…8
• CVE-2024-3790Vulnerability in WBSAirback 21.02.04, which consists of a st…4.8
• CVE-2024-37901XWiki Platform is a generic wiki platform offering runtime s…8.8
• CVE-2024-37902DeepJavaLibrary(DJL) is an Engine-Agnostic Deep Learning Fra…10
• CVE-2024-37903Mastodon is a self-hosted, federated microblogging platform.…8.2
• CVE-2024-37904Minder is an open source Software Supply Chain Security Plat…5.7
• CVE-2024-37905authentik is an open-source Identity Provider that emphasize…8.8
• CVE-2024-37906Admidio is a free, open source user management system for we…8.8