CVE-2023-26472

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

XWiki Platform is a generic wiki platform. Starting in version 6.2-milestone-1, one can execute any wiki content with the right of IconThemeSheet author by creating an icon theme with certain content. This can be done by creating a new page or even through the user profile for users not having edit right. The issue has been patched in XWiki 14.9, 14.4.6, and 13.10.10. An available workaround is to fix the bug in the page `IconThemesCode.IconThemeSheet` by applying a modification from commit 48caf7491595238af2b531026a614221d5d61f38.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-116

Affected software

No affected versions have been published.

Timeline

Published
Mar 2, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-264736.5XWiki Platform is a generic wiki platform. Starting in version 1.3-rc-1, any user with edit right can execute arbitrary database select and CVE-2023-264748.8XWiki Platform is a generic wiki platform. Starting in version 13.10, it's possible to use the right of an existing document content author CVE-2023-264758.8XWiki Platform is a generic wiki platform. Starting in version 2.3-milestone-1, the annotation displayer does not execute the content in a rCVE-2023-264767.5XWiki Platform is a generic wiki platform. Starting in version 3.2-m3, users can deduce the content of the password fields by repeated call CVE-2023-264779.8XWiki Platform is a generic wiki platform. Starting in versions 6.3-rc-1 and 6.2.4, it's possible to inject arbitrary wiki syntax including CVE-2023-264788.1XWiki Platform is a generic wiki platform. Starting in version 14.3-rc-1, `org.xwiki.store.script.TemporaryAttachmentsScriptService#uploadTeCVE-2023-264796.5XWiki Platform is a generic wiki platform. Starting in version 6.0, users with write rights can insert well-formed content that is not handlCVE-2023-26489.8A vulnerability was found in Weaver E-Office 9.5. It has been classified as critical. This affects an unknown part of the file /inc/jquery/uCVE-2023-264805.4XWiki Platform is a generic wiki platform. Starting in version 12.10, a user without script rights can introduce a stored cross-site scriptiCVE-2023-264816.5authentik is an open-source Identity Provider. Due to an insufficient access check, a recovery flow link that is created by an admin (or senCVE-2023-264828.8Nextcloud server is an open source home cloud implementation. In affected versions a missing scope validation allowed users to create workflCVE-2023-264835.3gosaml2 is a Pure Go implementation of SAML 2.0. SAML Service Providers using this library for SAML authentication support are likely suscep
CVE-2023-26472: High severity, CVSS 8.8 | Vulnix