Velocity code execution via document title reassignment

Code injection in XWiki Platform allows remote authenticated users to execute Velocity expressions through crafted document titles. The document tree macro passes an attacker-controlled title back to XWikiDocument.setTitle before reading plainTitle, causing evaluation during tree rendering. Creating and saving a document is required; the demonstrated consequence exposes request data in the navigation panel despite the absence of script right.