CVE-2024-55877

XWiki Platform is a generic wiki platform. Starting in version 9.7-rc-1 and prior to versions 15.10.11, 16.4.1, and 16.5.0, any user with an account can perform arbitrary remote code execution by adding instances of `XWiki.WikiMacroClass` to any page. This compromises the confidentiality, integrity and availability of the whole XWiki installation. This vulnerability has been fixed in XWiki 15.10.11, 16.4.1 and 16.5.0. It is possible to manually apply the patch to the page `XWiki.XWikiSyntaxMacrosList` as a workaround.

• CWE-96
• CWE-94

• https://github.com/xwiki/xwiki-platform/commit/40e1afe001d61eafdf13f3621b4b597a0e58a3e3Patch
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-2r87-74cx-2p7cVendor Advisory
• https://jira.xwiki.org/browse/XWIKI-22030Exploit, Vendor Advisory
• https://jira.xwiki.org/browse/XWIKI-22030Exploit, Vendor Advisory

Published

Dec 12, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-5585In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.…8.8
• CVE-2024-5586Zohocorp ManageEngine ADAudit Plus versions below 8121 are v…8.8
• CVE-2024-55864Cross-site scripting vulnerability exists in My WP Customize…4.8
• CVE-2024-5587A vulnerability was found in Casdoor up to 1.335.0. It has b…6.9
• CVE-2024-55875http4k is a functional toolkit for Kotlin HTTP applications.…9.8
• CVE-2024-55876XWiki Platform is a generic wiki platform. Starting in versi…5.4
• CVE-2024-55878SimpleXLSX is software for parsing and retrieving data from …6.8
• CVE-2024-55879XWiki Platform is a generic wiki platform. Starting in versi…8.8
• CVE-2024-5588A vulnerability was found in itsourcecode Learning Managemen…8.8
• CVE-2024-55881In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2024-55884In the Mullvad VPN client 2024.6 (Desktop), 2024.8 (iOS), an…9
• CVE-2024-55885beego is an open-source web framework for the Go programming…7.5