XWiki Commons may allow privilege escalation to programming rights via user's first name
Priority MEDIUM 45CWE-150Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.
Summary
XWiki Commons are technical libraries common to several other top level XWiki projects. Starting in version 3.1-milestone-1, any user can edit their own profile and inject code, which is going to be executed with programming right. The same vulnerability can also be exploited in all other places where short text properties are displayed, e.g., in apps created using Apps Within Minutes that use a short text field. The problem has been patched on versions 13.10.9, 14.4.4, 14.7RC1.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01163 67th percentileScored 2026-11-07
Public exploit Yes 3 exploit referencesTagged by NVD
Fix Fixed xwiki-commons (xwiki): 13.10.9, 14.4.4, 14.7-rc-1org.xwiki.commons:xwiki-commons-xml (Maven): 13.10.9, 14.4.4, 14.7-rc-1
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| XWiki | xwiki-commons | 3.1-milestone-1 to before 13.10.9; 14.0-rc-1 to before 14.4.4; 14.5 to before 14.7-rc-1 | 13.10.9, 14.4.4, 14.7-rc-1 | Patch available | CNA |
| — | org.xwiki.commons:xwiki-commons-xml (Maven) | 3.1-milestone-1 to before 13.10.9 | 13.10.9 | Patch available | GHSA-8cw6-4r32-6r3h |
| — | org.xwiki.commons:xwiki-commons-xml (Maven) | 14.0-rc-1 to before 14.4.4 | 14.4.4 | Patch available | GHSA-8cw6-4r32-6r3h |
| — | org.xwiki.commons:xwiki-commons-xml (Maven) | 14.5 to before 14.7-rc-1 | 14.7-rc-1 | Patch available | GHSA-8cw6-4r32-6r3h |
- xwiki-commons VendorXWiki Affected 3.1-milestone-1 to before 13.10.9; 14.0-rc-1 to before 14.4.4; 14.5 to before 14.7-rc-1 Fixed in 13.10.9, 14.4.4, 14.7-rc-1 Patch available CNA
- org.xwiki.commons:xwiki-commons-xml (Maven) Vendor— Affected 3.1-milestone-1 to before 13.10.9 Fixed in 13.10.9 Patch available GHSA-8cw6-4r32-6r3h
- org.xwiki.commons:xwiki-commons-xml (Maven) Vendor— Affected 14.0-rc-1 to before 14.4.4 Fixed in 14.4.4 Patch available GHSA-8cw6-4r32-6r3h
- org.xwiki.commons:xwiki-commons-xml (Maven) Vendor— Affected 14.5 to before 14.7-rc-1 Fixed in 14.7-rc-1 Patch available GHSA-8cw6-4r32-6r3h
CPE configurations NVD · 5
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:xwiki:commons:*:*:*:*:*:*:*:* | 3.2 to before 13.10.9; 14.4 to before 14.4.4; 14.5 to before 14.7 | Vulnerable | XWiki |
| cpe:2.3:a:xwiki:commons:3.1:milestone1:*:*:*:*:*:* | 3.1 milestone1 | Vulnerable | XWiki |
| cpe:2.3:a:xwiki:commons:3.1:milestone2:*:*:*:*:*:* | 3.1 milestone2 | Vulnerable | XWiki |
| cpe:2.3:a:xwiki:commons:3.1.1:*:*:*:*:*:*:* | 3.1.1 | Vulnerable | XWiki |
| cpe:2.3:a:xwiki:commons:14.4:rc1:*:*:*:*:*:* | 14.4 rc1 | Vulnerable | XWiki |
- cpe:2.3:a:xwiki:commons:*:*:*:*:*:*:*:* Versions 3.2 to before 13.10.9; 14.4 to before 14.4.4; 14.5 to before 14.7 Vulnerable ·XWiki
- cpe:2.3:a:xwiki:commons:3.1:milestone1:*:*:*:*:*:* Versions 3.1 milestone1 Vulnerable ·XWiki
- cpe:2.3:a:xwiki:commons:3.1:milestone2:*:*:*:*:*:* Versions 3.1 milestone2 Vulnerable ·XWiki
- cpe:2.3:a:xwiki:commons:3.1.1:*:*:*:*:*:*:* Versions 3.1.1 Vulnerable ·XWiki
- cpe:2.3:a:xwiki:commons:14.4:rc1:*:*:*:*:*:* Versions 14.4 rc1 Vulnerable ·XWiki
Remediation
- Fix · CNA xwiki-commons (xwiki) Fixed in 13.10.9, 14.4.4, 14.7-rc-1
- Fix · GHSA-8cw6-4r32-6r3h org.xwiki.commons:xwiki-commons-xml (Maven) Fixed in 13.10.9 Advisory →
- Fix · GHSA-8cw6-4r32-6r3h org.xwiki.commons:xwiki-commons-xml (Maven) Fixed in 14.4.4 Advisory →
- Fix · GHSA-8cw6-4r32-6r3h org.xwiki.commons:xwiki-commons-xml (Maven) Fixed in 14.7-rc-1 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2023-26055
- 2026-10-03 Alias added: GHSA-8cw6-4r32-6r3h
References
Exploit 3
More XWiki Commons vulnerabilities
- TI-2023-18312 HTML sanitizer allows form elements in restricted in org.xwiki.commons:xwiki-commons-xml CVSS 3.1CRITICAL 9.1
- TI-2022-08708 Arbitrary file access through XML parsing in org.xwiki.commons:xwiki-commons-xml CVSS 3.1MEDIUM 4.9
- TI-2023-13896 Cross-site Scripting in org.xwiki.commons:xwiki-commons-xml CVSS 3.1CRITICAL 9.1
Sources
- CVE-2023-26055 · CVE Program
- CVE-2023-26055 · NVD
- FIRST EPSS
- GHSA-8cw6-4r32-6r3h · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences