An authenticated administrator can exploit a Server-Side Template Injection vulnerability in XWiki versions up to 17.3.0 to potentially achieve remote code execution or sensitive data leakage.

This is a Server-Side Template Injection (SSTI) flaw located in the HTTP Meta Info field of the Global Preferences Presentation section. An authenticated administrator can inject malicious Apache Velocity template code that the server renders without validation.

Successful exploitation allows an attacker with administrative access to bypass intended restrictions and execute arbitrary server-side logic. Given the CVSS score of 8.8, this vulnerability poses a high risk of total system compromise, including unauthorized access to sensitive internal configuration data and potential remote code execution, which could lead to complete loss of confidentiality, integrity, and availability of the XWiki instance.

Immediate Action: Administrators should monitor the vendor security advisories at xwiki.org for the release of a patched version and apply it immediately upon availability.

Proactive Monitoring: Security teams should monitor server access logs for anomalous behavior in the administration interface and audit changes made to the Global Preferences Presentation settings.

Compensating Controls: Implement strict network access controls to the administrative interface and utilize a Web Application Firewall (WAF) to detect and block malicious Velocity template syntax in HTTP requests.

Public Exploit Available: Yes — a published proof-of-concept exists in the researcher's write-up referenced by the CVE record.

Due to the high severity of this vulnerability and the presence of a published proof-of-concept, organizations should treat this as a priority update. While the vulnerability requires administrative authentication, the potential for total system compromise necessitates immediate review of administrative access and strict adherence to the principle of least privilege until a vendor-supplied patch is deployed.