CVE-2022-36094: XWiki Platform stored XSS via attachment history view

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

high priorityCritical CVSS and very high EPSS with a public exploit reference, but exploitation requires a low-privileged attacker and victim interaction, and no KEV listing is present.

What it is

XWiki Platform versions from 1.0 up to 13.10.6 and 14.3RC1 allow stored JavaScript to be executed when a user views the history of an attachment whose filename contains JavaScript. The flaw is a cross-site scripting issue in the viewattachrev.vm entry point, and it matters because the script runs in the context of any user viewing that history page.

Impact

An attacker can execute arbitrary JavaScript in the victim's browser session, potentially stealing session cookies, performing actions as the victim, or exfiltrating data accessible to that user. The CVSS vector indicates high confidentiality, integrity, and availability impact within a changed scope.

Attack surface

The attack is network-reachable and requires the attacker to have low privileges to store the malicious attachment name, while the victim must view the attachment history (user interaction required). No authentication is needed for the victim beyond being able to access the history page.

Exploitation

No CISA KEV listing is present, but EPSS is 0.64098 (99.188th percentile) and a vendor Jira reference is tagged as Exploit, indicating public exploit information exists.

What to do

• Upgrade XWiki to 13.10.6 or 14.3RC1 or later.
• If immediate upgrade is not possible, replace viewattachrev.vm with the patched version from the vendor patch.
• Restrict attachment upload and history-viewing permissions to trusted users until patched.
• Review attachment names for embedded JavaScript and remove or rename suspicious attachments.

Detection

• Search web server and application logs for requests to viewattachrev.vm with attachment names containing script-like patterns.
• Monitor for attachment uploads or renames where the filename contains HTML or JavaScript syntax.
• Inspect XWiki audit logs for unexpected attachment history views by low-privileged accounts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.