CVE-2023-26262

An issue was discovered in Sitecore XP/XM 10.3. As an authenticated Sitecore user, a unrestricted language file upload vulnerability exists the can lead to direct code execution on the content management (CM) server.

• CWE-434
• CWE-434

• https://github.com/istern/CVE-2023-26262Exploit, Mitigation, Third Party Advisory
• https://www.sitecore.com/trustVendor Advisory
• https://github.com/istern/CVE-2023-26262Exploit, Mitigation, Third Party Advisory
• https://www.sitecore.com/trustVendor Advisory

Published

Mar 14, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-26256An unauthenticated path traversal vulnerability affects the …7.5
• CVE-2023-26257An issue was discovered in the Connected Vehicle Systems All…7.5
• CVE-2023-26258Arcserve UDP through 9.0.6034 allows authentication bypass. …9.8
• CVE-2023-2626There exists an authentication bypass vulnerability in OpenT…8.8
• CVE-2023-26260OXID eShop 6.2.x before 6.4.4 and 6.5.x before 6.5.2 allows …5.4
• CVE-2023-26261In UBIKA WAAP Gateway/Cloud through 6.10, a blind XPath inje…9.8
• CVE-2023-26263All versions of Talend Data Catalog before 8.0-20230110 are …5.5
• CVE-2023-26264All versions of Talend Data Catalog before 8.0-20220907 are …5.5
• CVE-2023-26265The Borg theme before 1.1.19 for Backdrop CMS does not suffi…5.3
• CVE-2023-26266In AFL++ 4.05c, the CmpLog component uses the current workin…7.3
• CVE-2023-26267php-saml-sp before 1.1.1 and 2.x before 2.1.1 allows reading…6.5
• CVE-2023-26268Design documents with matching document IDs, from databases …5.3