What’s Vulnerable › Vulnerabilities

CVE-2023-27480: Data leak through a XAR import XXE attack in xwiki-platform-xar-model

• Severity: high (CVSS 7.7 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2023-03-07 · updated 2026-06-17
• Weakness: CWE-611

Description

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions any user with edit rights on a document can trigger an XAR import on a forged XAR file, leading to the ability to display the content of any file on the XWiki server host. This vulnerability has been patched in XWiki 13.10.11, 14.4.7 and 14.10-rc-1. Users are advised to upgrade. Users unable to upgrade may apply the patch `e3527b98fd` manually.

Affected products

• xwiki-platform: from 1.1 (excl.) before 13.10.11; from 14.0 before 14.4.7; from 14.5 before 14.10; 1.1-milestone3, 1.1-milestone4 — fixed in 13.10.11, 14.10, 14.4.7

How to fix

Upgrade to a fixed version: xwiki-platform 13.10.11, 14.10, 14.4.7. Check the vendor advisory for mitigations.

References

• https://github.com/xwiki/xwiki-platform/commit/e3527b98fdd8dc8179c24dc55e662b2c55199434
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-gx4f-976g-7g6v
• https://jira.xwiki.org/browse/XWIKI-20320
• https://github.com/xwiki/xwiki-platform/commit/e3527b98fdd8dc8179c24dc55e662b2c55199434
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-gx4f-976g-7g6v
• https://jira.xwiki.org/browse/XWIKI-20320

Get alerted when CVE-2023-27480 or the next vulnerability affects your stack