CVE-2022-24897 Arbitrary filesystem write access from Velocity

🗓️ 02 May 2022 21:49:17Reported by GoogleType

osv🔗 osv.dev👁 13 Views

Package for evaluating content with Velocity is vulnerable to improper sandboxing of velocity scripts, allowing unauthorized file read/write operations. Requires XWiki Script rights. Patched in versions 12.6.7, 12.10.3, and 13.0

Reporter	Title	Published	Views	Family All 13
Circl	CVE-2022-24897	21 May 202206:42	–	circl
CNNVD	XWiki Commons 路径遍历漏洞	2 May 202200:00	–	cnnvd
CVE	CVE-2022-24897	2 May 202221:49	–	cve
Cvelist	CVE-2022-24897 Arbitrary filesystem write access from Velocity	2 May 202221:49	–	cvelist
EUVD	EUVD-2022-1713	3 Oct 202520:07	–	euvd
Github Security Blog	Arbitrary filesystem write access from velocity.	28 Apr 202221:16	–	github
NVD	CVE-2022-24897	2 May 202222:15	–	nvd
OSV	GHSA-CVX5-M8VG-VXGC Arbitrary filesystem write access from velocity.	28 Apr 202221:16	–	osv
Prion	Code injection	2 May 202222:15	–	prion
Positive Technologies	PT-2022-16966 · Xwiki · Xwiki	28 Apr 202200:00	–	ptsecurity

Source	Link
jira	www.jira.xwiki.org/browse/XWIKI-5168
github	www.github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24897.json
github	www.github.com/xwiki/xwiki-commons/security/advisories/GHSA-cvx5-m8vg-vxgc
nvd	www.nvd.nist.gov/vuln/detail/CVE-2022-24897
github	www.github.com/xwiki/xwiki-commons/commit/215951cfb0f808d0bf5b1097c9e7d1e503449ab8
github	www.github.com/xwiki/xwiki-commons/pull/127

10 Apr 2026 04:45Current

7.6High risk

Vulners AI Score7.6

CVSS 3.17.5

EPSS0.00325