CVE-2022-29253

Path Traversal in XWiki Platform

State: Published
Severity: 2.7 Low
Published: May 25, 2022
Updated: Apr 23, 2025
Reserved: Apr 13, 2022

Description

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting with version 8.3-rc-1 and prior to versions 12.10.3 and 14.0, one can ask for any file located in the classloader using the template API and a path with ".." in it. The issue is patched in versions 14.0 and 13.10.3. There is no easy workaround for this issue.

Scores

CVSS	Score	Vector	Source
3.1	2.7 Low	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N	GitHub_M

Weaknesses

CWE-24 Path Traversal: '../filedir'
CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Affected Products

Product	Versions
xwiki-platformxwiki	>= 8.3-rc-1, < 13.10.3Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.