What’s Vulnerable › Vulnerabilities

CVE-2023-26475: XWiki Platform vulnerable to Remote Code Execution in Annotations

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 63.6% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2023-03-02 · updated 2026-06-17
• Weakness: CWE-269

Description

XWiki Platform is a generic wiki platform. Starting in version 2.3-milestone-1, the annotation displayer does not execute the content in a restricted context. This allows executing anything with the right of the author of any document by annotating the document. This has been patched in XWiki 13.10.11, 14.4.7 and 14.10. There is no easy workaround except to upgrade.

Affected products

• xwiki-platform: from 2.3 (excl.) before 13.10.11; from 14.0 before 14.4.7; from 14.5 before 14.10; 2.3-milestone1 — fixed in 13.10.11, 14.10, 14.4.7

How to fix

Upgrade to a fixed version: xwiki-platform 13.10.11, 14.10, 14.4.7. Check the vendor advisory for mitigations.

References

• https://github.com/xwiki/xwiki-platform/commit/d87d7bfd8db18c20d3264f98c6deefeae93b99f7
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-h6f5-8jj5-cxhr
• https://jira.xwiki.org/browse/XWIKI-20360
• https://jira.xwiki.org/browse/XWIKI-20384
• https://github.com/xwiki/xwiki-platform/commit/d87d7bfd8db18c20d3264f98c6deefeae93b99f7
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-h6f5-8jj5-cxhr
• https://jira.xwiki.org/browse/XWIKI-20360
• https://jira.xwiki.org/browse/XWIKI-20384

Get alerted when CVE-2023-26475 or the next vulnerability affects your stack