CVE-2022-24897 Arbitrary filesystem write access from Velocity
Attackers with Script rights can bypass Velocity sandboxing to read or write arbitrary files on the server filesystem.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-24897?
CVE-2022-24897 is a high-severity path traversal vulnerability in Xwiki Xwiki, published on 2 May 2022. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
APIs to evaluate content with Velocity is a package for APIs to evaluate content with Velocity. Starting with version 2.3 and prior to 12.6.7, 12.10.3, and 13.0, the velocity scripts are not properly sandboxed against using the Java File API to perform read or write operations on the filesystem. Writing an attacking script in Velocity requires the Script rights in XWiki so not all users can use it, and it also requires finding an XWiki API which returns a File. The problem has been patched in versions 12.6.7, 12.10.3, and 13.0. There is no easy workaround for fixing this vulnerability other than upgrading and being careful when giving Script rights.
Weakness: CWE-22
Which versions are affected by CVE-2022-24897?
4 open source packages ship an affected version, including org.xwiki.commons:xwiki-commons-velocity. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.xwiki.commons:xwiki-commons-velocity Maven | From 12.7.0 | 12.10.3 |
org.xwiki.commons:xwiki-commons-velocity Maven | From 12.7.0 | 12.10.3 |
org.xwiki.commons:xwiki-commons-velocity Maven | From 2.3.0 | 12.6.7 |
org.xwiki.commons:xwiki-commons-velocity Maven | From 2.3.0 | 12.6.7 |
Products include Xwiki Xwiki.
How do I fix CVE-2022-24897?
Upgrade org.xwiki.commons:xwiki-commons-velocity to a fixed version for your release line: 12.10.3 or 12.6.7.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2022-24897 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-24897 exists.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Xwiki Xwiki
- CVE-2025-24893 XWiki Platform Eval Injection
- CVE-2025-53836 XWiki Rendering is vulnerable to RCE attacks when processing nested macros
- CVE-2024-55662 XWiki allows remote code execution through the extension sheet
- CVE-2024-55877 XWiki allows remote code execution from account through macro descriptions and XWiki.XWikiSyntaxMacrosList
- CVE-2024-37901 XWiki Platform vulnerable to remote code execution from account via SearchSuggestConfigSheet
Sources
Also known as GHSA-cvx5-m8vg-vxgc.