CVE-2024-31465: XWiki Platform code injection via SearchSuggestSourceClass object

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityCVSS 8.8 and very high EPSS with a public exploit reference make this a high-priority remote code execution risk for exposed XWiki instances.

What it is

XWiki Platform allows any user with edit rights on any page to execute arbitrary code on the server by adding an object of type XWiki.SearchSuggestSourceClass to their user profile or another page. The flaw affects versions from 5.0-rc-1 up to 14.10.20, 15.5.4, and 15.9-rc-1, and compromises the confidentiality, integrity and availability of the whole installation.

Impact

An authenticated low-privileged editor gains remote code execution on the XWiki server, allowing full control over the application and its data. This can lead to data theft, tampering, or denial of service across the entire installation.

Attack surface

The attack is network-reachable and requires only an authenticated account with edit permission on at least one page; no user interaction beyond the attacker's own actions is needed. The CVSS vector AV:N/AC:L/PR:L/UI:N confirms low-privilege authenticated access over the network.

Exploitation

The vulnerability is not listed in CISA KEV, but EPSS is very high at 0.75575 (99.49th percentile), and a vendor JIRA reference is tagged Exploit, indicating public exploit information exists.

What to do

• Upgrade to XWiki 14.10.20, 15.5.4, or 15.10 RC1 or later.
• If immediate upgrade is not possible, manually apply the patch to the document XWiki.SearchSuggestSourceSheet as described in the vendor advisory.
• Restrict edit rights to trusted users only until patched.
• Monitor and audit pages for unexpected XWiki.SearchSuggestSourceClass objects.

Detection

• Search XWiki page objects for XWiki.SearchSuggestSourceClass instances that were not intentionally created.
• Review server logs for unexpected code execution or suspicious child processes spawned by the XWiki application.
• Alert on creation or modification of user profile pages containing unusual object types.
• Monitor for outbound network connections from the XWiki server that may indicate post-exploitation activity.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.