What’s Vulnerable › Vulnerabilities

CVE-2023-30537: org.xwiki.platform:xwiki-platform-flamingo-theme-ui vulnerable to privilege escalation

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.0% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2023-04-16 · updated 2026-06-17
• Weakness: CWE-95

Description

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with the right to add an object on a page can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation. The root cause is improper escaping of the styles properties `FlamingoThemesCode.WebHome`. This page is installed by default. The vulnerability has been patched in XWiki versions 13.10.11, 14.4.7 and 14.10.

Affected products

• xwiki-platform: from 12.6.6 before 13.10.11; from 14.0 before 14.4.7; from 14.5 before 14.10 — fixed in 13.10.11, 14.10, 14.4.7

How to fix

Upgrade to a fixed version: xwiki-platform 13.10.11, 14.10, 14.4.7. Check the vendor advisory for mitigations.

References

• https://github.com/xwiki/xwiki-platform/commit/df596f15368342236f8899ca122af8f3df0fe2e8
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-vrr8-fp7c-7qgp
• https://jira.xwiki.org/browse/XWIKI-20280
• https://github.com/xwiki/xwiki-platform/commit/df596f15368342236f8899ca122af8f3df0fe2e8
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-vrr8-fp7c-7qgp
• https://jira.xwiki.org/browse/XWIKI-20280

Get alerted when CVE-2023-30537 or the next vulnerability affects your stack