XWiki Platform vulnerable to Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in AttachmentSelector.xml
XWiki Platform vulnerable to Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in AttachmentSelector.xml. The issue can also be reproduced by inserting the dangerous payload in the `height` or `alt` macro properties. This has been patched in versions 13.10.7, 14.4.2, and 14.5. The issue can be fixed on a running wiki by updating `XWiki.AttachmentSelector` with the versions below: - 14.5-rc-1+: https://github.com/xwiki/xwiki-platform/commit/eb15147adf94bddb92626f862c1710d45bcd64a7#diff-e1513599ab698991f6cbba55d38f3f464432ced8d137a668b1f7618c7e747e23 - 14.4.2+: https://github.com/xwiki/xwiki-platform/commit/c02f8eb1f3c953d124f2c097021536f8bc00fa8d#diff-e1513599ab698991f6cbba55d38f3f464432ced8d137a668b1f7618c7e747e23 - 13.10.7+: https://github.com/xwiki/xwiki-platform/commit/efd0df0468d46149ba68b66660b93f31b6318515#diff-e1513599ab698991f6cbba55d38f3f464432ced8d137a668b1f7618c7e747e23
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2022-41928
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 2 Nov 2026, 16:08 UTC · Revision 1
Source evidence
XWiki Platform vulnerable to Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in AttachmentSelector.xml
core-osv · Original sourcePublished 23 Nov 2022, 00:00 UTC
XWiki Platform vulnerable to Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in AttachmentSelector.xml. The issue can also be reproduced by inserting the dangerous payload in the `height` or `alt` macro properties. This has been patched in versions 13.10.7, 14.4.2, and 14.5. The issue can be fixed on a running wiki by updating `XWiki.AttachmentSelector` with the versions below: - 14.5-rc-1+: https://github.com/xwiki/xwiki-platform/commit/eb15147adf94bddb92626f862c1710d45bcd64a7#diff-e1513599ab698991f6cbba55d38f3f464432ced8d137a668b1f7618c7e747e23 - 14.4.2+: https://github.com/xwiki/xwiki-platform/commit/c02f8eb1f3c953d124f2c097021536f8bc00fa8d#diff-e1513599ab698991f6cbba55d38f3f464432ced8d137a668b1f7618c7e747e23 - 13.10.7+: https://github.com/xwiki/xwiki-platform/commit/efd0df0468d46149ba68b66660b93f31b6318515#diff-e1513599ab698991f6cbba55d38f3f464432ced8d137a668b1f7618c7e747e23
osv:CVE-2022-41928
Complete source record
{
"id": "8217a69eff1b53b70fd5da3def548dabf4a092b21279305504e83f2c075615cd",
"url": "https://osv.dev/vulnerability/CVE-2022-41928",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "XWiki Platform vulnerable to Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in AttachmentSelector.xml",
"summary": "XWiki Platform vulnerable to Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in AttachmentSelector.xml. The issue can also be reproduced by inserting the dangerous payload in the `height` or `alt` macro properties. This has been patched in versions 13.10.7, 14.4.2, and 14.5. The issue can be fixed on a running wiki by updating `XWiki.AttachmentSelector` with the versions below: - 14.5-rc-1+: https://github.com/xwiki/xwiki-platform/commit/eb15147adf94bddb92626f862c1710d45bcd64a7#diff-e1513599ab698991f6cbba55d38f3f464432ced8d137a668b1f7618c7e747e23 - 14.4.2+: https://github.com/xwiki/xwiki-platform/commit/c02f8eb1f3c953d124f2c097021536f8bc00fa8d#diff-e1513599ab698991f6cbba55d38f3f464432ced8d137a668b1f7618c7e747e23 - 13.10.7+: https://github.com/xwiki/xwiki-platform/commit/efd0df0468d46149ba68b66660b93f31b6318515#diff-e1513599ab698991f6cbba55d38f3f464432ced8d137a668b1f7618c7e747e23",
"evidence": "osv:CVE-2022-41928",
"products": [],
"severity": "critical",
"structured": {
"id": "CVE-2022-41928",
"aliases": [
"CVE-2022-41928",
"GHSA-9hqh-fmhg-vq2j"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/xwiki/xwiki-commons",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "ea813db28a986642d4862cef18015f0e7e8b7e29"
},
{
"fixed": "1626dc5a57e7bced8ee3864d9f47703f62f6e146"
},
{
"introduced": "bfebbb47f5fbf4e4b3b8996785b5e27b04d0a850"
},
{
"last_affected": "a36ffd8b17ef0eddcbd9a6f3ccc5cf82abb28754"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "13.10.7"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "14.0.0"
},
{
"fixed": "14.4.2"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:xwiki:xwiki:5.0:milestone1:*:*:*:*:*:*",
"range": [
{
"introduced": "5.0-milestone1"
},
{
"last_affected": "5.0-milestone1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:xwiki:xwiki:5.0:milestone2:*:*:*:*:*:*",
"range": [
{
"introduced": "5.0-milestone2"
},
{
"last_affected": "5.0-milestone2"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:xwiki:xwiki:14.4.3:*:*:*:*:*:*:*",
"range": [
{
"introduced": "14.4.3"
},
{
"last_affected": "14.4.3"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:xwiki:xwiki:14.4.4:*:*:*:*:*:*:*",
"range": [
{
"introduced": "14.4.4"
},
{
"last_affected": "14.4.4"
}
],
"source": "CPE_STRING"
}
]
}
},
{
"repo": "https://github.com/xwiki/xwiki-platform",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "950f435a66fb9fe437d27df8a6aaf20e01322e1f"
},
{
"fixed": "cc3304eb18e40b836f37b9ee12ffa15c9f99285a"
},
{
"introduced": "8f431e0388bc2591ab2122a704a6de9ce1d72fb0"
},
{
"last_affected": "daf5e736b51daba27b5ddff3bd363dd33bd3cf35"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "13.10.7"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "14.0.0"
},
{
"fixed": "14.4.2"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:xwiki:xwiki:5.0:milestone1:*:*:*:*:*:*",
"range": [
{
"introduced": "5.0-milestone1"
},
{
"last_affected": "5.0-milestone1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:xwiki:xwiki:5.0:milestone2:*:*:*:*:*:*",
"range": [
{
"introduced": "5.0-milestone2"
},
{
"last_affected": "5.0-milestone2"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:xwiki:xwiki:14.4.3:*:*:*:*:*:*:*",
"range": [
{
"introduced": "14.4.3"
},
{
"last_affected": "14.4.3"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:xwiki:xwiki:14.4.4:*:*:*:*:*:*:*",
"range": [
{
"introduced": "14.4.4"
},
{
"last_affected": "14.4.4"
}
],
"source": "CPE_STRING"
}
]
}
}
],
"versions": [
"14.4.3",
"14.4.4",
"5.0-milestone1",
"5.0-milestone2",
"xwiki-commons-14.4.1",
"xwiki-commons-13.10.6",
"xwiki-commons-14.4",
"xwiki-commons-14.4-rc-1",
"xwiki-commons-13.10.5",
"xwiki-commons-13.10.4",
"xwiki-commons-13.10.3",
"xwiki-commons-13.10.2",
"xwiki-commons-13.10.1",
"xwiki-commons-13.10",
"xwiki-commons-13.10-rc-1",
"xwiki-commons-8.3-milestone-2",
"xwiki-commons-8.3-milestone-1",
"xwiki-commons-8.2-milestone-2",
"xwiki-commons-8.2-milestone-1",
"xwiki-commons-8.1-milestone-2",
"xwiki-commons-8.1-milestone-1",
"xwiki-commons-8.0-milestone-2",
"xwiki-commons-8.0-milestone-1",
"xwiki-platform-14.4.1",
"xwiki-platform-13.10.6",
"xwiki-platform-14.4",
"xwiki-platform-14.4-rc-1",
"xwiki-platform-13.10.5",
"xwiki-platform-13.10.4",
"xwiki-platform-13.10.3",
"xwiki-platform-13.10.2",
"xwiki-platform-13.10.1",
"xwiki-platform-13.10",
"xwiki-platform-13.10-rc-1",
"xwiki-platform-9.9-rc-2",
"xwiki-platform-8.3-milestone-1",
"xwiki-platform-8.2-milestone-2",
"xwiki-platform-8.2-milestone-1",
"xwiki-platform-8.1-milestone-2",
"xwiki-platform-8.1-milestone-1",
"xwiki-platform-8.0-milestone-2",
"xwiki-platform-8.0-milestone-1",
"xwiki-platform-7.4-milestone-2",
"xwiki-platform-7.4-milestone-1",
"xwiki-platform-7.3-milestone-2"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-41928.json"
}
}
],
"modified": "2026-10-28T02:30:20.591174587Z",
"provider": "osv",
"references": [
"https://jira.xwiki.org/browse/XWIKI-19800",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/41xxx/CVE-2022-41928.json",
"https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-9hqh-fmhg-vq2j",
"https://nvd.nist.gov/vuln/detail/CVE-2022-41928"
],
"provider_metadata": {
"cwe_ids": [
"CWE-95"
],
"cna_assigner": "GitHub_M",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/41xxx/CVE-2022-41928.json"
}
},
"related_cves": [
{
"value": "CVE-2022-41928",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 486948,
"published_at": "2022-11-23T00:00:00+00:00"
}