CVE-2023-26470

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It's possible to make the farm unusable by adding an object to a page with a huge number (e.g. 67108863). Most of the time this will fill the memory allocated to XWiki and make it unusable every time this document is manipulated. This issue has been patched in XWiki 14.0-rc-1.

• CWE-400
• CWE-787

• https://github.com/xwiki/xwiki-platform/commit/04e5a89d2879b160cdfaea846024d3d9c1a525e6Patch
• https://github.com/xwiki/xwiki-platform/commit/db3d1c62fc5fb59fefcda3b86065d2d362f55164Patch
• https://github.com/xwiki/xwiki-platform/commit/fdfce062642b0ac062da5cda033d25482f4600faPatch
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-92wp-r7hm-42g7Exploit, Vendor Advisory
• https://jira.xwiki.org/browse/XWIKI-19223Exploit, Issue Tracking, Patch, Vendor Advisory
• https://github.com/xwiki/xwiki-platform/commit/04e5a89d2879b160cdfaea846024d3d9c1a525e6Patch
• https://github.com/xwiki/xwiki-platform/commit/db3d1c62fc5fb59fefcda3b86065d2d362f55164Patch
• https://github.com/xwiki/xwiki-platform/commit/fdfce062642b0ac062da5cda033d25482f4600faPatch
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-92wp-r7hm-42g7Exploit, Vendor Advisory
• https://jira.xwiki.org/browse/XWIKI-19223Exploit, Issue Tracking, Patch, Vendor Advisory

Published

Mar 2, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-26465Pega Platform versions 7.2 to 8.8.1 are affected by an XSS i…6.1
• CVE-2023-26466A user with non-Admin access can change a configuration file…7.8
• CVE-2023-26467A man in the middle can redirect traffic to a malicious serv…5.4
• CVE-2023-26468Cerebrate 1.12 does not properly consider organisation_id du…9.1
• CVE-2023-26469In Jorani 1.0.0, an attacker could leverage path traversal t…9.8
• CVE-2023-2647A vulnerability was found in Weaver E-Office 9.5 and classif…8.8
• CVE-2023-26471XWiki Platform is a generic wiki platform. Starting in versi…8.8
• CVE-2023-26472XWiki Platform is a generic wiki platform. Starting in versi…8.8
• CVE-2023-26473XWiki Platform is a generic wiki platform. Starting in versi…6.5
• CVE-2023-26474XWiki Platform is a generic wiki platform. Starting in versi…8.8
• CVE-2023-26475XWiki Platform is a generic wiki platform. Starting in versi…8.8
• CVE-2023-26476XWiki Platform is a generic wiki platform. Starting in versi…7.5