CVE-2020-11057: XWiki

High severity, CVSS 8.8. EPSS: 2.2% chance of exploitation in the next 30 days.

In XWiki Platform 7.2 through 11.10.2, registered users without scripting/programming permissions are able to execute python/groovy scripts while editing personal dashboards. This has been fixed 11.3.7 , 11.10.3 and 12.0.

Affected products

• XWiki XWiki: from 7.2, up to and including 11.10.2

Published 2020-05-12. Last modified 2026-06-17.