CVE-2023-26472

XWiki Platform is a generic wiki platform. Starting in version 6.2-milestone-1, one can execute any wiki content with the right of IconThemeSheet author by creating an icon theme with certain content. This can be done by creating a new page or even through the user profile for users not having edit right. The issue has been patched in XWiki 14.9, 14.4.6, and 13.10.10. An available workaround is to fix the bug in the page `IconThemesCode.IconThemeSheet` by applying a modification from commit 48caf7491595238af2b531026a614221d5d61f38.

• CWE-116
• CWE-116

• https://github.com/xwiki/xwiki-platform/commit/48caf7491595238af2b531026a614221d5d61f38#diff-2ec9d716673ee049937219cdb0a92e520f81da14ea84d144504b97ab2bdae243R45Patch
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-vwr6-qp4q-2wj7Exploit, Vendor Advisory
• https://jira.xwiki.org/browse/XWIKI-19731Exploit, Issue Tracking, Patch, Vendor Advisory
• https://github.com/xwiki/xwiki-platform/commit/48caf7491595238af2b531026a614221d5d61f38#diff-2ec9d716673ee049937219cdb0a92e520f81da14ea84d144504b97ab2bdae243R45Patch
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-vwr6-qp4q-2wj7Exploit, Vendor Advisory
• https://jira.xwiki.org/browse/XWIKI-19731Exploit, Issue Tracking, Patch, Vendor Advisory

Published

Mar 2, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-26467A man in the middle can redirect traffic to a malicious serv…5.4
• CVE-2023-26468Cerebrate 1.12 does not properly consider organisation_id du…9.1
• CVE-2023-26469In Jorani 1.0.0, an attacker could leverage path traversal t…9.8
• CVE-2023-2647A vulnerability was found in Weaver E-Office 9.5 and classif…8.8
• CVE-2023-26470XWiki Platform is a generic wiki platform offering runtime s…7.5
• CVE-2023-26471XWiki Platform is a generic wiki platform. Starting in versi…8.8
• CVE-2023-26473XWiki Platform is a generic wiki platform. Starting in versi…6.5
• CVE-2023-26474XWiki Platform is a generic wiki platform. Starting in versi…8.8
• CVE-2023-26475XWiki Platform is a generic wiki platform. Starting in versi…8.8
• CVE-2023-26476XWiki Platform is a generic wiki platform. Starting in versi…7.5
• CVE-2023-26477XWiki Platform is a generic wiki platform. Starting in versi…9.8
• CVE-2023-26478XWiki Platform is a generic wiki platform. Starting in versi…8.1