cvedb.io
CVE-2023-36470
CRITICAL · CVSS 9.9
EPSS exploitation probability: 0%
Published 2023-06-29T21:15:09.843 · Last modified 2026-06-17T06:06:19.940

Summary

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. By either creating a new or editing an existing document with an icon set, an attacker can inject XWiki syntax and Velocity code that is executed with programming rights and thus allows remote code execution. There are different attack vectors, the simplest is the Velocity code in the icon set's HTML or XWiki syntax definition. The [icon picker](https://extensions.xwiki.org/xwiki/bin/view/Extension/Icon%20Theme%20Application#HIconPicker) can be used to trigger the rendering of any icon set. The XWiki syntax variant of the icon set is also used without any escaping in some documents, allowing to inject XWiki syntax including script macros into a document that might have programming right

Affected products

xwiki — xwiki

Does this affect you?

Add your gear to cvedb and we'll alert you only when xwiki ships something exploited.

Check my exposure →

References

This product uses data from the NVD API but is not endorsed or certified by the NVD. Informational only; not professional security advice.