{"id":"CVE-2023-26475","url":"https://www.cyber-defence.io/tools/cve/CVE-2023-26475","generatedAt":"2026-10-23T16:09:48.762Z","title":"Starting in version 2.3-milestone-1, the annotation displayer does not execute the content in a restricted context.","description":"XWiki Platform is a generic wiki platform. Starting in version 2.3-milestone-1, the annotation displayer does not execute the content in a restricted context. This allows executing anything with the right of the author of any document by annotating the document. This has been patched in XWiki 13.10.11, 14.4.7 and 14.10. There is no easy workaround except to upgrade.","published":"2023-03-02T19:15:11.000Z","lastModified":"2026-06-17T05:43:25.000Z","status":"Modified","sourceIdentifier":"security-advisories@github.com","cvss":{"version":"3.1","score":8.8,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"cwe":["CWE-269","CWE-270"],"affected":["xwiki/xwiki"],"epss":{"score":0.63587,"percentile":0.99216,"date":"2026-10-22","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"urgent","text":"EPSS puts the probability of exploitation in the next 30 days at 63.6%, higher than 99% of all known CVEs. Patch or mitigate before the next change window."},"changes":[],"references":[{"url":"https://github.com/xwiki/xwiki-platform/commit/d87d7bfd8db18c20d3264f98c6deefeae93b99f7","tags":["Patch"],"source":"security-advisories@github.com"},{"url":"https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-h6f5-8jj5-cxhr","tags":["Exploit","Vendor Advisory"],"source":"security-advisories@github.com"},{"url":"https://jira.xwiki.org/browse/XWIKI-20360","tags":["Exploit","Issue Tracking","Patch","Vendor Advisory"],"source":"security-advisories@github.com"},{"url":"https://jira.xwiki.org/browse/XWIKI-20384","tags":["Issue Tracking","Patch","Vendor Advisory"],"source":"security-advisories@github.com"},{"url":"https://github.com/xwiki/xwiki-platform/commit/d87d7bfd8db18c20d3264f98c6deefeae93b99f7","tags":["Patch"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-h6f5-8jj5-cxhr","tags":["Exploit","Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://jira.xwiki.org/browse/XWIKI-20360","tags":["Exploit","Issue Tracking","Patch","Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://jira.xwiki.org/browse/XWIKI-20384","tags":["Issue Tracking","Patch","Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2023-26475","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}