XWiki Rendering CVE-2025-53837

Requires an authenticated account with edit rights over at least one document - realistically any user who can edit their own user profile, which includes self-registered users on many deployments. The attacker must be able to add an object (e.g., XWiki.UIExtensionClass) or place content whose rendered output is embedded inside an HTML macro; exploitable sinks include the user profile directly (present since XWiki syntax v2 / exploitable from XWiki 3.3 M1) and extension points such as org.xwiki.platform.search.ui.docdoesnotexist (added in XWiki 8.3 M1). No special non-default server configuration is needed and no victim user interaction is required beyond the content being rendered. Limiting factors: attacker needs a valid low-privilege account (PR:L, so not fully unauthenticated), and instances that disable open registration and restrict edit rights raise the bar. Affected versions are xwiki-rendering-xml < 14.10.2; patched in 14.10.2 and 15.0 RC1.

This is a genuine high-priority vulnerability, not a CVSS-inflated non-issue. The vendor CVSS 3.1 score of 9.9 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) is well-supported: any authenticated low-privilege user (PR:L) who can edit their own profile can achieve remote code execution with programming rights over the entire wiki (C:H/I:H/A:H, scope-changed S:C). The scope change and low privilege bar are the key severity drivers - self-registration is common on many wikis, effectively lowering the practical barrier. However, several signals are missing: no EPSS score is provided, the CVE is NOT in CISA KEV (no confirmed active exploitation), and no weaponized POC is published, though the advisory contains a fully detailed, reproducible proof-of-concept (exact object type, payload, extension point, and verification URL). SSVC data is absent. The realistic conclusion: exploitation status is 'no public exploit identified at time of analysis,' but the advisory's step-by-step reproduction is effectively an exploit recipe, so the gap between disclosure and working exploit is small. There is no conflict between the CVSS network vector and the description - both align on remote, authenticated (low-priv) exploitation.

A low-privileged registered user edits their own user profile (or any document they can edit) and adds an XWiki.UIExtensionClass object whose content closes the surrounding HTML macro and injects a Groovy or Python script macro. When the rendered output is viewed, the injected macro executes with programming rights, giving the attacker arbitrary code execution and full read/write access to all wiki content. No published weaponized exploit exists, but the advisory provides a complete, reproducible proof-of-concept payload and verification URL.