CVE-2023-26472

CRITICAL

XWiki 6.2.1-13.10.9 - Unauthenticated Remote Code Execution via Icon Theme Sheet Injection

Title source: llm

Description

XWiki Platform is a generic wiki platform. Starting in version 6.2-milestone-1, one can execute any wiki content with the right of IconThemeSheet author by creating an icon theme with certain content. This can be done by creating a new page or even through the user profile for users not having edit right. The issue has been patched in XWiki 14.9, 14.4.6, and 13.10.10. An available workaround is to fix the bug in the page `IconThemesCode.IconThemeSheet` by applying a modification from commit 48caf7491595238af2b531026a614221d5d61f38.

References (3)

Core 3

Core References

Exploit, Vendor Advisory x_refsource_confirm

https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-vwr6-qp4q-2wj7

Patch x_refsource_misc

https://github.com/xwiki/xwiki-platform/commit/48caf7491595238af2b531026a614221d5d61f38#diff-2ec9d716673ee049937219cdb0a92e520f81da14ea84d144504b97ab2bdae243R45

View Patch ZIP pw:eip

Exploit, Issue Tracking, Patch, Vendor Advisory x_refsource_misc

https://jira.xwiki.org/browse/XWIKI-19731

Scores

CVSS v3 9.9

EPSS 0.0111

EPSS Percentile 61.4%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-116

Status published

Products (3)

org.xwiki.platform/xwiki-platform-icon-ui 6.2-milestone-1 - 13.10.10Maven

xwiki/xwiki 6.2 milestone1 (2 CPE variants)

xwiki/xwiki 6.2.1 - 13.10.10

Published Mar 02, 2023

Tracked Since Feb 18, 2026