CVE-2022-36100: XWiki Tag UI document allows code injection with programming rights

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityCVSS 8.8 with low privileges and no user interaction, plus very high EPSS and public exploit references, make this a high-priority patch despite no KEV listing.

What it is

The Main.Tags document in XWiki Platform Applications Tag and Tag UI did not sanitize user input, letting users with view rights execute arbitrary Groovy, Python and Velocity code with programming rights. This breaks all rights checks, allowing modification and disclosure of all wiki content and impacting availability. Patched in 13.10.6 and 14.4.

Impact

An attacker gains code execution with programming rights, can bypass all access controls, read or modify any stored content, and degrade wiki availability.

Attack surface

Reached remotely over the network through the tags document; only view rights on that document are needed (default for public wikis or authenticated users on private wikis), with no user interaction. On versions before 13.10.4 and 14.2, chaining with CVE-2022-36092 removes the rights requirement entirely.

Exploitation

Not listed in CISA KEV, but EPSS is 0.73608 (99.4th percentile) and multiple references are tagged Exploit, indicating public exploit material exists.

What to do

• Upgrade to XWiki 13.10.6 or 14.4 (or later) to apply the official patch.
• If immediate upgrade is not possible, manually apply the patch to the Main.Tags document or import the updated document from xwiki-platform-tag-ui 14.4 via the administration import feature on XWiki 10.9 and later.
• Restrict view rights on Main.Tags and limit wiki access to trusted users until patched.
• Review and revert any unexpected changes to wiki content or configuration that may indicate prior exploitation.

Detection

• Monitor wiki logs and audit trails for edits or requests touching Main.Tags outside normal administrative activity.
• Alert on Groovy, Python or Velocity code execution events originating from tag document rendering.
• Hunt for anomalous content modifications or mass data access consistent with rights bypass.
• Correlate with exploitation attempts of CVE-2022-36092 on versions before 13.10.4 and 14.2.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.