cve.bz

CVE-2023-26472

8.8 highEPSS 1.1%

High (8.8) in xwiki xwiki. EPSS 1.1% chance of exploitation in the next 30 days. Fixed in org.xwiki.platform:xwiki-platform-icon-ui 13.10.10, 14.4.6, 14.9.

XWiki Platform is a generic wiki platform. Starting in version 6.2-milestone-1, one can execute any wiki content with the right of IconThemeSheet author by creating an icon theme with certain content. This can be done by creating a new page or even through the user profile for users not having edit right. The issue has been patched in XWiki 14.9, 14.4.6, and 13.10.10. An available workaround is to fix the bug in the page `IconThemesCode.IconThemeSheet` by applying a modification from commit 48caf7491595238af2b531026a614221d5d61f38.

Severity

CVSS 3.1

8.8 high
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS
1.1% chance of exploitation in the next 30 days; higher than 65% of CVEs (scores of 2026-10-31)
CWE
CWE-116
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-vwr6-qp4q-2wj7Mavenorg.xwiki.platform:xwiki-platform-icon-ui>=6.2-milestone-1 <13.10.1013.10.10
GHSA-vwr6-qp4q-2wj7Mavenorg.xwiki.platform:xwiki-platform-icon-ui>=14.0 <14.4.614.4.6
GHSA-vwr6-qp4q-2wj7Mavenorg.xwiki.platform:xwiki-platform-icon-ui>=14.5 <14.914.9

References

Check your stackJSON