What is CVE-2022-41931?

CVE-2022-41931 is a critical-severity vulnerability in Xwiki, classified under Eval Injection. CVSS score: 9.9/10. Published 2022-11-23.

How severe is CVE-2022-41931?

Critical severity. CVSS v3 base score is 9.9 out of 10.

RCE in Xwiki

CVE-2022-41931

xwiki-platform-icon-ui is vulnerable to Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection'). Any user with view rights on commonly accessible documents including the icon picker macro can execute arbitrary Groovy, Python or Velocity code in XWiki due to improper neutralization of the macro parameters of the icon picker macro. The problem has been patched in XWiki 13.10.7, 14.5 and 14.4.2. Workarounds: The [patch](https://github.com/xwiki/xwiki-platform/commit/47eb8a5fba550f477944eb6da8ca91b87eaf1d01) can be manually applied by editing `IconThemesCode.IconPickerMacro` in the object editor. The whole document can also be replaced by the current version by importing the document from the XAR archive of a fixed version as the only changes to the document have been security fixes and small formatting changes.

Published 2022-11-23 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 9.9 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H.

EPSS exploit prediction

EPSS: 0.013 (68.8th percentile), scored 2026-10-04.

Low probability of exploitation in the next 30 days, but still tracked. 69th percentile — 68.8% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.012 · newest: 0.013 · change: +0.000

Affected products

Xwiki — versions 6.4, 14.4.3, 14.4.4
Xwiki Xwiki-Platform — versions >= 6.4-milestone-2, < 13.10.7, >= 14.0.0, < 14.4.2

Weakness classification (CWE)

CWE-95 — Eval Injection

References

github.com/xwiki/xwiki-platform/security/advisories/GHSA-5j7g-cf6r-g2h7 (Exploit, Patch, Third Party Advisory)
github.com/xwiki/xwiki-platform/commit/47eb8a5fba550f477944eb6da8ca91b87eaf1d01 (Patch, Third Party Advisory)
jira.xwiki.org/browse/XWIKI-19805 (Exploit, Patch, Issue Tracking, Vendor Advisory)

Frequently asked questions

What is CVE-2022-41931?: CVE-2022-41931 is a critical-severity vulnerability in Xwiki, classified under Eval Injection. CVSS score: 9.9/10. Published 2022-11-23.
How severe is CVE-2022-41931?: Critical severity. CVSS v3 base score is 9.9 out of 10.