CVE-2025-53835

The XHTML syntax in XWiki Rendering had a dependency on xdom+xml/current syntax, which enables the creation of so-called raw blocks — blocks that allow injection of arbitrary HTML content, including JavaScript scripts. A user with permissions to edit any document (e.g., their own profile, which is enabled by default) can introduce a malicious payload that will be executed in the browser of the victim viewing that document. The attack does not require special administrative privileges and can be initiated remotely.

An attacker can execute arbitrary JavaScript code in the context of the victim's browser, leading to session theft, user account takeover, or access to sensitive application data. Due to the changed scope (S:C) and high impact on confidentiality, integrity, and availability, the consequences may extend beyond the current user session.

XWiki Rendering should be updated to version 14.10 or later, which removes the XHTML syntax dependency on xdom+xml/current. The vendor does not indicate any known workarounds — updating is the only effective method. It is also recommended not to install or use xdom+xml syntax in production environments, as its primary purpose is testing.

XWiki Rendering in versions 5.4.5 through earlier than 14.10. The xdom+xml syntax (without the /current suffix) remains vulnerable even after applying the patch.