CVE-2025-53835

XWiki Rendering is a generic rendering system that converts textual input in a given syntax (wiki syntax, HTML, etc) into another syntax (XHTML, etc). Starting in version 5.4.5 and prior to version 14.10, the XHTML syntax depended on the `xdom+xml/current` syntax which allows the creation of raw blocks that permit the insertion of arbitrary HTML content including JavaScript. This allows XSS attacks for users who can edit a document like their user profile (enabled by default). This has been fixed in version 14.10 by removing the dependency on the `xdom+xml/current` syntax from the XHTML syntax. Note that the `xdom+xml` syntax is still vulnerable to this attack. As it's main purpose is testing and its use is quite difficult, this syntax shouldn't be installed or used on a regular wiki. There are no known workarounds apart from upgrading.

• CWE-79
• CWE-80

• https://github.com/xwiki/xwiki-rendering/commit/a4ca31f99f524b9456c64150d6f375984aa81ea7Patch
• https://github.com/xwiki/xwiki-rendering/security/advisories/GHSA-w3wh-g4m9-783pPatch, Third Party Advisory
• https://jira.xwiki.org/browse/XRENDERING-660Issue Tracking
• https://github.com/xwiki/xwiki-rendering/security/advisories/GHSA-w3wh-g4m9-783pPatch, Third Party Advisory

Published

Jul 14, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-5383A vulnerability was found in Yifang CMS up to 2.0.2 and clas…4.8
• CVE-2025-53830Anti-Virus for ownCloud is an anti-virus application for fil…9.1
• CVE-2025-53831DrawIO for ownCloud is an application for using DrawIO with …8.2
• CVE-2025-53832Lara Translate MCP Server is a Model Context Protocol (MCP) …7.5
• CVE-2025-53833LaRecipe is an application that allows users to create docum…10
• CVE-2025-53834Caido is a web security auditing toolkit. A reflected cross-…6.3
• CVE-2025-53836XWiki Rendering is a generic rendering system that converts …8.8
• CVE-2025-53838LinkAce is a self-hosted archive to collect website links. A…5.4
• CVE-2025-53839DRACOON is a file sharing service, and the DRACOON Branding …4
• CVE-2025-5384A vulnerability was found in JeeWMS up to 20250504. It has b…9.8
• CVE-2025-53840Icinga DB Web provides a graphical interface for Icinga moni…2.4
• CVE-2025-53841The GC-AGENTS-SERVICE running as part of Akamai´s Guardicore…7.8