CVE-2023-26475

PoC ×2—

CVSS 3.1

8.8 high

EPSS

64%p99

Published

Mar 2, 2023 (Mar 2, 2023)

Modified

Jun 17, 2026

Description

XWiki Platform is a generic wiki platform. Starting in version 2.3-milestone-1, the annotation displayer does not execute the content in a restricted context. This allows executing anything with the right of the author of any document by annotating the document. This has been patched in XWiki 13.10.11, 14.4.7 and 14.10. There is no easy workaround except to upgrade.

Vendors: xwiki
Products: xwiki
Weakness: CWE-269, CWE-270
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (63.6%)

In the news0 stories

No ingested article mentions this CVE yet.