CVE-2022-29253

    Dashboard / Vulnerabilities / CVE-2022-29253

    CVE-2022-29253

    Published: 25 May 2022Last Modified: 12 Aug 2026

    Summary: Path Traversal in XWiki Platform

    Details: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting with version 8.3-rc-1 and prior to versions 12.10.3 and 14.0, one can ask for any file located in the classloader using the template API and a path with ".." in it. The issue is patched in versions 14.0 and 13.10.3. There is no easy workaround for this issue.

    References: https://jira.xwiki.org/browse/XWIKI-19349, https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/29xxx/CVE-2022-29253.json, https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-9qrp-h7fw-42hg, https://nvd.nist.gov/vuln/detail/CVE-2022-29253, https://github.com/xwiki/xwiki-platform/commit/4917c8f355717bb636d763844528b1fe0f95e8e2

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 56ed2775cbc176e6530326cedb82919802fd9b3f
    Fixed -e201b487c1366fcd5b45734a1ea92f0c89621de9

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2022-29253 | CVE-DB