CVE-2023-26559

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-04-14 · updated 2026-06-17
Weakness: CWE-22

Description

A directory traversal vulnerability in Oxygen XML Web Author before 25.0.0.3 build 2023021715 and Oxygen Content Fusion before 5.0.3 build 2023022015 allows an attacker to read files from a WEB-INF directory via a crafted HTTP request. (XML Web Author 24.1.0.3 build 2023021714 and 23.1.1.4 build 2023021715 are also fixed versions.)

Affected products

Sync Oxygen Content Fusion: before 5.0.3 — fixed in 5.0.3
Sync Oxygen Xml Web Author: before 23.1.1.4; from 24.0.0.0 before 24.1.0.3; from 25.0.0.0 before 25.1.0.3 — fixed in 23.1.1.4, 24.1.0.3, 25.1.0.3

How to fix

Upgrade to a fixed version: Sync Oxygen Content Fusion 5.0.3; Sync Oxygen Xml Web Author 23.1.1.4, 24.1.0.3, 25.1.0.3. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-26559 or the next vulnerability affects your stack