XWiki Rendering Vulnerability in XWiki Product
CVE-2025-53836
Currently unrated
What is CVE-2025-53836?
The vulnerability in the XWiki Rendering component allows for unauthorized execution of macros in restricted mode due to a flaw in the default macro content parser. In certain versions of XWiki, this flaw enables executing prohibited macros, notably script macros, potentially leading to script execution vulnerabilities. This risk is particularly concerning when untrusted users are involved, as they could gain access to functionalities that should typically be restricted. Users are advised to disable comment functionality for untrusted users until the system is upgraded to patched versions (13.10.11, 14.4.7, or 14.10) that rectify this issue.