{"id":"CVE-2023-26475","published":"2023-03-02T18:07:04Z","modified":"2025-03-05T21:23:14Z","title":"XWiki Platform vulnerable to Remote Code Execution in Annotations","vendor":"xwiki","product":"xwiki-platform","tier":"core","eol":null,"affectedVersions":[{"vendor":"xwiki","product":"xwiki-platform","versions":[">= 2.3-milestone-1, < 13.10.11",">= 14.0-rc-1, < 14.4.7",">= 14.5, < 14.10"]}],"description":{"text":"XWiki Platform is a generic wiki platform. Starting in version 2.3-milestone-1, the annotation displayer does not execute the content in a restricted context. This allows executing anything with the right of the author of any document by annotating the document. This has been patched in XWiki 13.10.11, 14.4.7 and 14.10. There is no easy workaround except to upgrade.","provenance":"source","from":"CVE.org"},"summary":{"text":"A flaw in the annotation displayer of XWiki Platform (xwiki-platform) means that annotation content is not executed in a restricted context. An attacker who has a low-privilege account and can add annotations to a document can run code with the rights of that document's author, with no user interaction required.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:14:21Z"},"cvss":{"score":10,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.63587,"percentile":0.99214,"date":"2026-10-31","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":null,"cwes":[{"id":"CWE-270","name":"Privilege Context Switching Error"},{"id":"CWE-269","name":"Improper Privilege Management"}],"references":[{"url":"https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-h6f5-8jj5-cxhr","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/xwiki/xwiki-platform/commit/d87d7bfd8db18c20d3264f98c6deefeae93b99f7","tags":["x_refsource_MISC"]},{"url":"https://jira.xwiki.org/browse/XWIKI-20360","tags":["x_refsource_MISC"]},{"url":"https://jira.xwiki.org/browse/XWIKI-20384","tags":["x_refsource_MISC"]}],"techniques":[],"reports":[],"affected":[{"ecosystem":"Maven","package":"org.xwiki.platform:xwiki-platform-annotation-ui","vulnerableRanges":[">=2.3-milestone-1, <13.10.11",">=14.0-rc-1, <14.4.7",">=14.5, <14.10"],"patched":["13.10.11","14.4.7","14.10"],"from":["GHSA-h6f5-8jj5-cxhr"],"provenance":"source"}],"advisories":[{"id":"GHSA-h6f5-8jj5-cxhr","url":"https://github.com/advisories/GHSA-h6f5-8jj5-cxhr","severity":"CRITICAL","ecosystem":"Maven","package":"org.xwiki.platform:xwiki-platform-annotation-ui","vulnerableRanges":[">=2.3-milestone-1, <13.10.11"],"patched":["13.10.11"],"provenance":"source","from":"GHSA"},{"id":"GHSA-h6f5-8jj5-cxhr","url":"https://github.com/advisories/GHSA-h6f5-8jj5-cxhr","severity":"CRITICAL","ecosystem":"Maven","package":"org.xwiki.platform:xwiki-platform-annotation-ui","vulnerableRanges":[">=14.0-rc-1, <14.4.7"],"patched":["14.4.7"],"provenance":"source","from":"GHSA"},{"id":"GHSA-h6f5-8jj5-cxhr","url":"https://github.com/advisories/GHSA-h6f5-8jj5-cxhr","severity":"CRITICAL","ecosystem":"Maven","package":"org.xwiki.platform:xwiki-platform-annotation-ui","vulnerableRanges":[">=14.5, <14.10"],"patched":["14.10"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2023-1025","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-1025","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[],"timeline":[{"date":"2023-03-02","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2023-26475","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":26.8,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.84,"detail":"percentile 0.9921"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":7.0,"detail":"base score 10"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}