CVE-2022-24897

    Dashboard / Vulnerabilities / CVE-2022-24897

    CVE-2022-24897

    Published: 2 May 2022Last Modified: 12 Aug 2026

    Summary: Arbitrary filesystem write access from Velocity

    Details: APIs to evaluate content with Velocity is a package for APIs to evaluate content with Velocity. Starting with version 2.3 and prior to 12.6.7, 12.10.3, and 13.0, the velocity scripts are not properly sandboxed against using the Java File API to perform read or write operations on the filesystem. Writing an attacking script in Velocity requires the Script rights in XWiki so not all users can use it, and it also requires finding an XWiki API which returns a File. The problem has been patched in versions 12.6.7, 12.10.3, and 13.0. There is no easy workaround for fixing this vulnerability other than upgrading and being careful when giving Script rights.

    References: https://jira.xwiki.org/browse/XWIKI-5168, https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24897.json, https://github.com/xwiki/xwiki-commons/security/advisories/GHSA-cvx5-m8vg-vxgc, https://nvd.nist.gov/vuln/detail/CVE-2022-24897, https://github.com/xwiki/xwiki-commons/commit/215951cfb0f808d0bf5b1097c9e7d1e503449ab8, https://github.com/xwiki/xwiki-commons/pull/127

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -eb0223af7c2f08c62fbe1b381b12b465d6f4f39e

    Affected versions

    xwiki-commons-12.10.2
    xwiki-commons-12.10.1
    xwiki-commons-12.10

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2022-24897 | CVE-DB