CVE-2022-29258 Cross-site Scripting in Filter Stream Converter Application in XWiki Platform

What is CVE-2022-29258?

CVE-2022-29258 is a high-severity cross-site scripting vulnerability in Xwiki Xwiki, published on 31 May 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

XWiki Platform Filter UI provides a generic user interface to convert from a XWiki Filter input stream to an output stream with settings for each stream. Starting with versions 6.0-milestone-2 and 5.4.4 and prior to versions 12.10.11, 14.0-rc-1, 13.4.7, and 13.10.3, XWiki Platform Filter UI contains a possible cross-site scripting vector in the `Filter.FilterStreamDescriptorForm` wiki page related to pretty much all the form fields printed in the home page of the application. The issue is patched in versions 12.10.11, 14.0-rc-1, 13.4.7, and 13.10.3. The easiest workaround is to edit the wiki page `Filter.FilterStreamDescriptorForm` (with wiki editor) according to the instructions in the GitHub Security Advisory.

Weakness: CWE-79, CWE-80, CWE-116

Which versions are affected by CVE-2022-29258?

6 open source packages ship an affected version, including org.xwiki.platform:xwiki-platform-filter-ui. It affects 1 product.

Products include Xwiki Xwiki.

How do I fix CVE-2022-29258?

Upgrade org.xwiki.platform:xwiki-platform-filter-ui to a fixed version for your release line: 13.4.7, 13.10.3 or 12.10.11.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2022-29258 being exploited?

There is no known exploitation of CVE-2022-29258 in the wild and no public exploit code.

Other vulnerabilities in Xwiki Xwiki

• CVE-2025-24893 XWiki Platform Eval Injection Exploited Critical 9.8
• CVE-2025-53836 XWiki Rendering is vulnerable to RCE attacks when processing nested macros Critical 10.0
• CVE-2024-55662 XWiki allows remote code execution through the extension sheet Critical 10.0
• CVE-2024-55877 XWiki allows remote code execution from account through macro descriptions and XWiki.XWikiSyntaxMacrosList Critical 10.0
• CVE-2024-37901 XWiki Platform vulnerable to remote code execution from account via SearchSuggestConfigSheet Critical 10.0

All Xwiki Xwiki vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-xjfw-5vv5-vjq2.