CVE-2025-52133 Overview
CVE-2025-52133 is a stored cross-site scripting (XSS) vulnerability in the Mocca Calendar application for XWiki. Versions before 2.15 fail to sanitize the title field when importing a calendar, allowing an authenticated user to inject arbitrary HTML or JavaScript. The payload executes in the browser of any user who later views the imported calendar entry.
The weakness is tracked as CWE-79: Improper Neutralization of Input During Web Page Generation. Because XWiki renders user content within an authenticated session, injected scripts can act on behalf of the viewer, including administrators.
Critical Impact
An authenticated attacker can store malicious JavaScript in a calendar title through the import feature. The script executes in other users' browsers with their session context, enabling account takeover, data theft, and privilege escalation within the XWiki instance.
Affected Products
- XWiki Mocca Calendar application (community build)
- XWiki Mocca Calendar application (XWiki SAS build)
- All versions prior to 2.15
Discovery Timeline
- 2025-08-03 - CVE-2025-52133 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-52133
Vulnerability Analysis
The Mocca Calendar extension for XWiki provides calendar management features, including the ability to import calendar data. The import handler accepts a title field and persists it to the backing XWiki document. When the calendar is later rendered, the title is output into the HTML response without adequate escaping.
An attacker with permission to import a calendar can submit a crafted title containing HTML tags or JavaScript event handlers. Any user viewing the imported calendar triggers execution of the stored payload in the context of the XWiki origin.
Because the attack scope changes (per the CVSS vector), the injected script can interact with resources beyond the vulnerable component itself. Typical exploitation outcomes include session cookie theft, forced actions through CSRF-like requests, and theft of content the viewing user can access.
Root Cause
The root cause is missing output encoding of the calendar title during rendering. The import path trusts input that originates from an authenticated user and stores it verbatim. The rendering template then emits the stored string into HTML without context-aware escaping, satisfying the conditions for stored XSS.
Attack Vector
Exploitation requires network access to the XWiki instance and low-privileged authenticated access sufficient to use the calendar import feature. No user interaction is required beyond a victim viewing the affected calendar. The vulnerability is described in detail in GitHub Security Advisory GHSA-mc3x-h7p6-334p.
The vulnerability manifests when imported calendar titles are rendered. See the advisory and the XWiki Contributors MoccaCalendar repository for implementation details.
Detection Methods for CVE-2025-52133
Indicators of Compromise
- Calendar entries containing HTML tags such as <script>, <img onerror=, or <svg onload= in title fields.
- Unexpected outbound requests from browsers of users who viewed calendar pages, particularly to attacker-controlled domains.
- XWiki audit log entries showing calendar import actions from unusual accounts or at unusual times.
Detection Strategies
- Query the XWiki document store for Mocca Calendar objects whose title fields contain angle brackets, javascript: URIs, or on*= event handlers.
- Inspect HTTP request bodies to calendar import endpoints for payloads containing script fragments.
- Correlate browser console errors, Content Security Policy violation reports, or anomalous DOM modifications on calendar pages with recent import activity.
Monitoring Recommendations
- Enable and centrally collect XWiki access and action logs, focusing on calendar import operations and the users performing them.
- Deploy a Content Security Policy that restricts inline script execution and report violations to a monitored endpoint.
- Review new or modified Mocca Calendar documents regularly and alert on titles containing HTML metacharacters.
How to Mitigate CVE-2025-52133
Immediate Actions Required
- Upgrade the Mocca Calendar extension to version 2.15 or later on all XWiki instances.
- Audit existing calendar entries for malicious payloads in title fields and remove or sanitize any suspicious entries.
- Restrict calendar import permissions to trusted users until the patch is applied.
Patch Information
Upgrade to Mocca Calendar version 2.15 or newer. Patched builds are available through the XWiki MoccaCalendar extension page and the XWiki SAS repository. Review the GHSA-mc3x-h7p6-334p advisory for the full fix description.
Workarounds
- Temporarily disable the Mocca Calendar extension if an immediate upgrade is not possible.
- Remove calendar import rights from untrusted user groups through XWiki rights management.
- Enforce a strict Content Security Policy on the XWiki instance to limit the impact of injected scripts.
# Configuration example
# Verify installed Mocca Calendar version via XWiki extension manager
curl -u admin:password \
"https://xwiki.example.com/xwiki/rest/extensions/org.xwiki.contrib:application-mocca-calendar-ui"
# Example CSP response header to mitigate inline script execution
# Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none'; report-uri /csp-report
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
