https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 10 Oct 2026 08:20:48 +0000 https://cve.radiocsirt.org/vuln/cve-2025-32971 <p><strong>Affected:</strong> xwiki-platform</p> <p>XWiki is a generic wiki platform. In versions starting from 4.5.1 to before 15.10.13, from 16.0.0-rc-1 to before 16.4.4, and from 16.5.0-rc-1 to before 16.8.0-rc-1, the Solr script service doesn&#39;t take dropped programming rights into account. The Solr script service that is accessible in XWiki&#39;s scripting API normally requires programming rights to be called. Due to using the wrong API for checking rights, it doesn&#39;t take the fact into account that programming rights might have been dropped by calling `$xcontext.dropPermissions()`. If some code relies on this for the safety of executing Velocity code with the wrong author context, this could allow a user with script rights to either cause a high load by indexing documents or to temporarily remove documents from the search index. This issue has been patched in versions 15.10.13, 16.4.4, and 16.8.0-rc-1.</p> <p><strong>Affected:</strong> xwiki-platform</p> <p>XWiki is a generic wiki platform. In versions starting from 4.5.1 to before 15.10.13, from 16.0.0-rc-1 to before 16.4.4, and from 16.5.0-rc-1 to before 16.8.0-rc-1, the Solr script service doesn&#39;t take dropped programming rights into account. The Solr script service that is accessible in XWiki&#39;s scripting API normally requires programming rights to be called. Due to using the wrong API for checking rights, it doesn&#39;t take the fact into account that programming rights might have been dropped by calling `$xcontext.dropPermissions()`. If some code relies on this for the safety of executing Velocity code with the wrong author context, this could allow a user with script rights to either cause a high load by indexing documents or to temporarily remove documents from the search index. This issue has been patched in versions 15.10.13, 16.4.4, and 16.8.0-rc-1.</p> https://cve.radiocsirt.org/vuln/cve-2025-32971 https://cve.radiocsirt.org/vuln/ghsa-987p-r3jc-8c8v <p><strong>Affected:</strong> Maven: org.xwiki.platform:xwiki-platform-search-solr-api</p> <p>### Impact The Solr script service that is accessible in XWiki&#39;s scripting API normally requires programming right to be called. Due to using the wrong API for checking rights, it doesn&#39;t take the fact into account that programming rights might have been dropped by calling `$xcontext.dropPermissions()`. If some code relies on this for the safety of executing Velocity code with the wrong author context, this could allow a user with script right to either cause a high load by indexing documents or to temporarily remove documents from the search index. We&#39;re not aware that this is exploitable in XWiki itself.</p> <p>To reproduce, a user with programming right can add the following XWiki syntax to a page: ``` {{velocity}} $xcontext.dropPermissions() $services.solr.index(&#39;document:xwiki:Main.WebHome&#39;) {{/velocity}} ```</p> <p>This should trigger an error in XWiki&#39;s log, otherwise the installation is vulnerable.</p> <p>### Patches This has been patched in XWiki 15.10.13, 16.8.0RC1, and 16.4.4.</p> <p>### Workarounds We&#39;re not aware of any workarounds apart from being careful whom you grant script right.</p> <p><strong>Affected:</strong> Maven: org.xwiki.platform:xwiki-platform-search-solr-api</p> <p>### Impact The Solr script service that is accessible in XWiki&#39;s scripting API normally requires programming right to be called. Due to using the wrong API for checking rights, it doesn&#39;t take the fact into account that programming rights might have been dropped by calling `$xcontext.dropPermissions()`. If some code relies on this for the safety of executing Velocity code with the wrong author context, this could allow a user with script right to either cause a high load by indexing documents or to temporarily remove documents from the search index. We&#39;re not aware that this is exploitable in XWiki itself.</p> <p>To reproduce, a user with programming right can add the following XWiki syntax to a page: ``` {{velocity}} $xcontext.dropPermissions() $services.solr.index(&#39;document:xwiki:Main.WebHome&#39;) {{/velocity}} ```</p> <p>This should trigger an error in XWiki&#39;s log, otherwise the installation is vulnerable.</p> <p>### Patches This has been patched in XWiki 15.10.13, 16.8.0RC1, and 16.4.4.</p> <p>### Workarounds We&#39;re not aware of any workarounds apart from being careful whom you grant script right.</p> https://cve.radiocsirt.org/vuln/ghsa-987p-r3jc-8c8v