CVE-2025-52131: XWiki Mocca Calendar XSS Vulnerability

CVE-2025-52131 Overview

CVE-2025-52131 is a stored cross-site scripting (XSS) vulnerability [CWE-79] in the Mocca Calendar application for XWiki. Versions prior to 2.15 fail to sanitize input supplied through the background color and text color fields. An authenticated attacker can inject arbitrary JavaScript that executes in the browser of any user viewing the affected calendar entry. The scope-changing nature of the flaw allows the injected script to interact with the parent XWiki environment, including session cookies and application state.

Critical Impact
Low-privileged authenticated users can inject persistent JavaScript that runs under other users' XWiki sessions, enabling account takeover and data theft within the wiki.

Affected Products

Mocca Calendar extension for XWiki, versions prior to 2.15
XWiki Contrib distribution of application-mocca-calendar
XWiki SAS distribution of application-mocca-calendar

Discovery Timeline

2025-08-03 - CVE-2025-52131 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-52131

Vulnerability Analysis

The Mocca Calendar extension lets XWiki users create calendar entries with customizable styling, including configurable background and text colors. The application accepts these color values as free-form input and renders them directly into HTML attributes or inline CSS without proper encoding or validation. An attacker who can create or edit a calendar event can supply a crafted value in either color field that breaks out of the intended CSS context and injects script content.

Because the payload persists in the stored calendar document, every subsequent viewer executes the attacker's JavaScript. The CVSS vector indicates a changed scope, meaning the injected script runs with access to the parent XWiki page context. This enables theft of authentication cookies, forced actions as the victim, and lateral abuse of wiki administrative features when an administrator views the malicious entry.

Root Cause

The root cause is missing output encoding on user-controlled style attributes. The color field was treated as safe structured data rather than untrusted input, so the templating layer rendered the raw string into generated HTML. No allow-list of valid CSS color tokens, hex codes, or RGB values was enforced before rendering.

Attack Vector

Exploitation requires network access to the XWiki instance and an account with permission to create or edit Mocca Calendar entries. The attacker submits a crafted color value that terminates the enclosing CSS or HTML attribute and introduces an executable payload such as an event handler or <script> fragment. The payload fires whenever another user renders the calendar view. Technical details are available in GitHub Security Advisory GHSA-jvq4-j2qw-q7x2.

Detection Methods for CVE-2025-52131

Indicators of Compromise

Calendar event documents containing non-color characters such as <, >, ", script, or onerror in the background or text color properties.
Unexpected outbound requests from user browsers to attacker-controlled domains originating from XWiki calendar pages.
XWiki audit log entries showing calendar edits by low-privilege accounts followed by access from administrator accounts.

Detection Strategies

Query the XWiki document store for Mocca Calendar objects and flag color field values that do not match a strict pattern such as ^#[0-9a-fA-F]{3,8}$ or named CSS colors.
Deploy a Content Security Policy in report-only mode and alert on inline-script violations originating from calendar view URLs.
Review web server logs for POST requests to calendar edit endpoints followed by GET requests to view endpoints from different user sessions.

Monitoring Recommendations

Monitor the installed Mocca Calendar version through the XWiki Extension Manager and alert when it reports a version below 2.15.
Correlate calendar edit events with subsequent administrative sessions to identify potential exploitation chains.
Capture browser console errors and CSP violation reports centrally for retrospective hunting.

How to Mitigate CVE-2025-52131

Immediate Actions Required

Upgrade the Mocca Calendar extension to version 2.15 or later on all XWiki instances.
Audit existing calendar entries for malicious payloads in color fields and remove or sanitize offending records.
Rotate session cookies and API tokens for users who may have viewed compromised calendars.
Restrict calendar edit rights to trusted users until patching is complete.

Patch Information

The maintainers released version 2.15 of the Mocca Calendar extension, which adds input validation and output encoding for the color fields. Installation and release details are published on the XWiki Extension: MoccaCalendar page, with source changes available in the XWiki Contributor Mocca Calendar Repo and the XWiki SAS Mocca Calendar Repo.

Workarounds

Temporarily revoke edit permissions on the Mocca Calendar space for non-administrative users until the patch is applied.
Deploy a Content Security Policy that disallows inline scripts and event handlers on XWiki pages to limit payload execution.
Use a web application firewall rule to block calendar edit requests whose color parameters contain characters outside the #, 0-9, and a-f ranges.

bash

# Configuration example: upgrade Mocca Calendar via XWiki Extension Manager CLI
./xwiki-extension-manager install \
  --feature org.xwiki.contrib:application-mocca-calendar-ui \
  --version 2.15 \
  --namespace wiki:xwiki