CVE-2023-26477

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

XWiki Platform is a generic wiki platform. Starting in versions 6.3-rc-1 and 6.2.4, it's possible to inject arbitrary wiki syntax including Groovy, Python and Velocity script macros via the `newThemeName` request parameter (URL parameter), in combination with additional parameters. This has been patched in the supported versions 13.10.10, 14.9-rc-1, and 14.4.6. As a workaround, it is possible to edit `FlamingoThemesCode.WebHomeSheet` and manually perform the changes from the patch fixing the issue.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-95 CWE-94

Affected software

Vendor	Product	Versions
xwiki	xwiki-platform	>= 6.2.4, < 13.10.10; >= 14.0, < 14.4.6; >= 14.5, < 14.9-rc-1

References

https://github.com/xwiki/xwiki-platform/commit/ea2e615f50a918802fd60b09ec87aa04bc6ea8e2#diff-e2153fa59f9d92ef67b0afbf27984bd17170921a3b558fac227160003d0dfd2aR283-R284Patch
https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-x2qm-r4wx-8gpgExploit, Vendor Advisory
https://jira.xwiki.org/browse/XWIKI-19757Exploit, Issue Tracking, Vendor Advisory
https://github.com/xwiki/xwiki-platform/commit/ea2e615f50a918802fd60b09ec87aa04bc6ea8e2#diff-e2153fa59f9d92ef67b0afbf27984bd17170921a3b558fac227160003d0dfd2aR283-R284Patch
https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-x2qm-r4wx-8gpgExploit, Vendor Advisory
https://jira.xwiki.org/browse/XWIKI-19757Exploit, Issue Tracking, Vendor Advisory

Timeline

Published: Mar 2, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-264788.1XWiki Platform is a generic wiki platform. Starting in version 14.3-rc-1, `org.xwiki.store.script.TemporaryAttachmentsScriptService#uploadTe CVE-2023-264796.5XWiki Platform is a generic wiki platform. Starting in version 6.0, users with write rights can insert well-formed content that is not handl CVE-2023-26489.8A vulnerability was found in Weaver E-Office 9.5. It has been classified as critical. This affects an unknown part of the file /inc/jquery/u CVE-2023-264805.4XWiki Platform is a generic wiki platform. Starting in version 12.10, a user without script rights can introduce a stored cross-site scripti CVE-2023-264816.5authentik is an open-source Identity Provider. Due to an insufficient access check, a recovery flow link that is created by an admin (or sen CVE-2023-264828.8Nextcloud server is an open source home cloud implementation. In affected versions a missing scope validation allowed users to create workfl CVE-2023-264835.3gosaml2 is a Pure Go implementation of SAML 2.0. SAML Service Providers using this library for SAML authentication support are likely suscep CVE-2023-264848.2KubeVirt is a virtual machine management add-on for Kubernetes. In versions 0.59.0 and prior, if a malicious user has taken over a Kubernete CVE-2023-264857.5cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. A polynomial time complexity issue in cmar CVE-2023-264866.1Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs. The Vega `scale` CVE-2023-264876.1Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs.`lassoAppend' func CVE-2023-264886.5OpenZeppelin Contracts is a library for secure smart contract development. The ERC721Consecutive contract designed for minting NFTs in batch