{"id":"CVE-2023-26477","published":"2023-03-02T17:52:40Z","modified":"2025-03-05T21:27:38Z","title":"org.xwiki.platform:xwiki-platform-flamingo-theme-ui Eval Injection vulnerability","vendor":"xwiki","product":"xwiki-platform","tier":"core","eol":null,"affectedVersions":[{"vendor":"xwiki","product":"xwiki-platform","versions":[">= 6.2.4, < 13.10.10",">= 14.0, < 14.4.6",">= 14.5, < 14.9-rc-1"]}],"description":{"text":"XWiki Platform is a generic wiki platform. Starting in versions 6.3-rc-1 and 6.2.4, it's possible to inject arbitrary wiki syntax including Groovy, Python and Velocity script macros via the `newThemeName` request parameter (URL parameter), in combination with additional parameters. This has been patched in the supported versions 13.10.10, 14.9-rc-1, and 14.4.6. As a workaround, it is possible to edit `FlamingoThemesCode.WebHomeSheet` and manually perform the changes from the patch fixing the issue.\n","provenance":"source","from":"CVE.org"},"summary":{"text":"The flaw is an eval injection vulnerability in the xwiki-platform product's Flamingo theme UI component (org.xwiki.platform:xwiki-platform-flamingo-theme-ui), where arbitrary wiki syntax, including Groovy, Python and Velocity script macros, can be injected through the newThemeName request parameter. An unauthenticated remote attacker can exploit it over the network with a crafted URL that supplies this parameter together with additional parameters, with no user interaction required.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:14:15Z"},"cvss":{"score":10,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.74757,"percentile":0.99503,"date":"2026-10-30","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":0,"pulses":[],"provenance":"machine"},"cwes":[{"id":"CWE-95","name":"Improper Neutralization of Directives in Dynamically Evaluated Code"}],"references":[{"url":"https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-x2qm-r4wx-8gpg","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/xwiki/xwiki-platform/commit/ea2e615f50a918802fd60b09ec87aa04bc6ea8e2#diff-e2153fa59f9d92ef67b0afbf27984bd17170921a3b558fac227160003d0dfd2aR283-R284","tags":["x_refsource_MISC"]},{"url":"https://jira.xwiki.org/browse/XWIKI-19757","tags":["x_refsource_MISC"]}],"techniques":[],"reports":[],"affected":[{"ecosystem":"Maven","package":"org.xwiki.platform:xwiki-platform-flamingo-theme-ui","vulnerableRanges":[">=6.2.4, <13.10.10",">=14.0, <14.4.6",">=14.5, <14.9-rc-1"],"patched":["13.10.10","14.4.6","14.9-rc-1"],"from":["GHSA-x2qm-r4wx-8gpg"],"provenance":"source"}],"advisories":[{"id":"GHSA-x2qm-r4wx-8gpg","url":"https://github.com/advisories/GHSA-x2qm-r4wx-8gpg","severity":"CRITICAL","ecosystem":"Maven","package":"org.xwiki.platform:xwiki-platform-flamingo-theme-ui","vulnerableRanges":[">=6.2.4, <13.10.10"],"patched":["13.10.10"],"provenance":"source","from":"GHSA"},{"id":"GHSA-x2qm-r4wx-8gpg","url":"https://github.com/advisories/GHSA-x2qm-r4wx-8gpg","severity":"CRITICAL","ecosystem":"Maven","package":"org.xwiki.platform:xwiki-platform-flamingo-theme-ui","vulnerableRanges":[">=14.0, <14.4.6"],"patched":["14.4.6"],"provenance":"source","from":"GHSA"},{"id":"GHSA-x2qm-r4wx-8gpg","url":"https://github.com/advisories/GHSA-x2qm-r4wx-8gpg","severity":"CRITICAL","ecosystem":"Maven","package":"org.xwiki.platform:xwiki-platform-flamingo-theme-ui","vulnerableRanges":[">=14.5, <14.9-rc-1"],"patched":["14.9-rc-1"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2023-1137","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-1137","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[],"timeline":[{"date":"2023-03-02","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2023-26477","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":26.9,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.9,"detail":"percentile 0.9950"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":7.0,"detail":"base score 10"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-xwiki-platform-cve-2022-29251","parents":[{"from":"CVE-2022-29251","to":"CVE-2023-26477","relation":"successor","confidence":"high","kind":"lineage","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.xwiki.platform:xwiki-platform-flamingo-theme-ui","fromFixed":"13.10.3","toFixed":"13.10.10","daysApart":281},{"kind":"same-code","provenance":"machine","files":["xwiki-platform-core/xwiki-platform-flamingo/xwiki-platform-flamingo-theme/xwiki-platform-flamingo-theme-ui/src/main/resources/FlamingoThemesCode/WebHomeSheet.xml"],"commits":["https://github.com/xwiki/xwiki-platform/commit/bd935320bee3c27cf7548351b1d0f935f116d437","https://github.com/xwiki/xwiki-platform/commit/ea2e615f50a918802fd60b09ec87aa04bc6ea8e2"],"basis":"rarely changed file"}]}],"children":[{"from":"CVE-2023-26477","to":"CVE-2023-30537","relation":"successor","confidence":"high","kind":"lineage","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.xwiki.platform:xwiki-platform-flamingo-theme-ui","fromFixed":"13.10.10","toFixed":"13.10.11","daysApart":45},{"kind":"version-step","provenance":"source","package":"Maven:org.xwiki.platform:xwiki-platform-flamingo-theme-ui","fromFixed":"14.4.6","toFixed":"14.4.7","daysApart":45},{"kind":"same-code","provenance":"machine","files":["xwiki-platform-core/xwiki-platform-flamingo/xwiki-platform-flamingo-theme/xwiki-platform-flamingo-theme-ui/src/main/resources/FlamingoThemesCode/WebHomeSheet.xml"],"commits":["https://github.com/xwiki/xwiki-platform/commit/ea2e615f50a918802fd60b09ec87aa04bc6ea8e2","https://github.com/xwiki/xwiki-platform/commit/df596f15368342236f8899ca122af8f3df0fe2e8"],"basis":"rarely changed file"}]}],"packageHistory":[{"cve":"CVE-2022-29251","published":"2022-05-25","fixed":"13.10.3","kev":false},{"cve":"CVE-2023-26477","published":"2023-03-02","fixed":"14.9-rc-1","kev":false},{"cve":"CVE-2023-29509","published":"2023-04-16","fixed":"14.10","kev":false,"link":{"from":"CVE-2023-26477","to":"CVE-2023-29509","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.xwiki.platform:xwiki-platform-flamingo-theme-ui","fromFixed":"13.10.10","toFixed":"13.10.11","daysApart":45},{"kind":"version-step","provenance":"source","package":"Maven:org.xwiki.platform:xwiki-platform-flamingo-theme-ui","fromFixed":"14.4.6","toFixed":"14.4.7","daysApart":45}]}},{"cve":"CVE-2023-30537","published":"2023-04-16","fixed":"14.10","kev":false}],"package":"Maven:org.xwiki.platform:xwiki-platform-flamingo-theme-ui"}}