CVE-2025-53835: XWiki Rendering Vulnerable to XSS Attacks via Insecure XHTML Syntax
Summary
CVE-2025-53835: XWiki Rendering is vulnerable to XSS attacks through insecure XHTML syntax. Affects org.xwiki.rendering:xwiki-rendering-syntax-xhtml versions >= 5.4.5, < 14.10. Fixed in 14.10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
XWiki Rendering is a component of the XWiki platform that allows for the rendering of content in various formats, including XHTML. It is widely used for creating and managing web content in a collaborative environment. The package 'org.xwiki.rendering:xwiki-rendering-syntax-xhtml' specifically handles the XHTML syntax, enabling users to format their documents accordingly. However, a critical vulnerability has been identified that exposes users to cross-site scripting (XSS) attacks, particularly affecting those who can edit documents such as user profiles.
Vulnerability Detail
The vulnerability arises from the XHTML syntax's dependency on the 'xdom+xml/current' syntax, which permits the creation of raw blocks that can include arbitrary HTML content, including JavaScript. This flaw allows attackers to exploit the system by inserting malicious scripts into documents, leading to potential XSS attacks. Users with editing privileges can unknowingly introduce harmful content, compromising the security of the application and its users.
How To Fix
Minimum fixed version
14.10
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no known workarounds apart from upgrading to the patched version. It is advised not to use the 'xdom+xml' syntax as it remains vulnerable and is not intended for regular use.
Conclusion
The XWiki Rendering component is vulnerable to XSS attacks due to its reliance on an insecure XHTML syntax. Users are strongly encouraged to upgrade to version 14.10 or later to mitigate this risk. Regular monitoring and vulnerability assessments, such as those provided by Vulert, can help maintain application security.
See every vulnerability recorded for org.xwiki.rendering:xwiki-rendering-syntax-xhtml →
FAQ
CVE-2025-53835 is a critical vulnerability in the XWiki Rendering component that allows for XSS attacks through insecure XHTML syntax.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which analyzes your pom.xml for vulnerabilities.
Exploitation of this vulnerability can lead to unauthorized script execution, compromising user data and application integrity.
Yes, the vulnerability has been patched in version 14.10 of the affected package. Users should upgrade to this version to mitigate the risk.
If an immediate upgrade is not possible, it is recommended to limit user permissions and avoid using the vulnerable syntax until a patch can be applied.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.xwiki.rendering:xwiki-rendering-syntax-xhtml.
