XWiki Full Calendar Macro kwetsbaar voor SQL injection via Calendar.JSONService

The SQL Injection vulnerability in XWiki Macro FullCalendar poses a significant risk. Attackers can exploit this flaw by crafting malicious requests targeting the Calendar.JSONService page, which is accessible even to guest users. Successful exploitation could lead to the extraction of sensitive database information, such as user credentials, configuration details, or application data. Furthermore, attackers could leverage the SQL Injection to execute arbitrary commands on the database server, potentially leading to a complete compromise of the XWiki instance. The ability to launch a DoS attack adds another layer of potential disruption, as attackers could overload the database server with malicious queries, rendering the application unavailable to legitimate users.

Organizations utilizing XWiki with the Macro FullCalendar component, particularly those with public-facing calendars or less restrictive access controls, are at risk. Shared hosting environments where multiple XWiki instances share the same database are also particularly vulnerable, as a compromise of one instance could potentially impact others.

• java / server:

ps -ef | grep -i fullcalendar

• java / server:

journalctl -u xwiki | grep -i "Calendar.JSONService"

• generic web:

curl -I <xwiki_url>/xwiki/bin/calendar/Calendar.JSONService

• generic web:

grep -r 'Calendar.JSONService' /var/log/apache2/access.log

1. 2026-01-09Disclosure

   disclosure

1. Gereserveerd2025-11-17
2. Gepubliceerd2026-01-09
3. Gewijzigd2026-02-03
4. EPSS bijgewerkt2026-03-23

The primary mitigation for CVE-2025-65091 is to upgrade to XWiki Macro FullCalendar version 2.4.5 or later, which contains the necessary fix. If an immediate upgrade is not feasible due to compatibility concerns or testing requirements, a temporary workaround involves removing the Calendar.JSONService page. While this mitigates the vulnerability, it will also disable certain functionalities of the FullCalendar macro. Consider implementing Web Application Firewall (WAF) rules to filter out potentially malicious requests targeting the Calendar.JSONService endpoint. Regularly review XWiki configurations and access controls to ensure least privilege principles are enforced.