CVE-2023-26475

XWiki Platform is a generic wiki platform. Starting in version 2.3-milestone-1, the annotation displayer does not execute the content in a restricted context. This allows executing anything with the right of the author of any document by annotating the document. This has been patched in XWiki 13.10.11, 14.4.7 and 14.10. There is no easy workaround except to upgrade.

• CWE-269
• CWE-270
• CWE-269

• https://github.com/xwiki/xwiki-platform/commit/d87d7bfd8db18c20d3264f98c6deefeae93b99f7Patch
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-h6f5-8jj5-cxhrExploit, Vendor Advisory
• https://jira.xwiki.org/browse/XWIKI-20360Exploit, Issue Tracking, Patch, Vendor Advisory
• https://jira.xwiki.org/browse/XWIKI-20384Issue Tracking, Patch, Vendor Advisory
• https://github.com/xwiki/xwiki-platform/commit/d87d7bfd8db18c20d3264f98c6deefeae93b99f7Patch
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-h6f5-8jj5-cxhrExploit, Vendor Advisory
• https://jira.xwiki.org/browse/XWIKI-20360Exploit, Issue Tracking, Patch, Vendor Advisory
• https://jira.xwiki.org/browse/XWIKI-20384Issue Tracking, Patch, Vendor Advisory

Published

Mar 2, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-2647A vulnerability was found in Weaver E-Office 9.5 and classif…8.8
• CVE-2023-26470XWiki Platform is a generic wiki platform offering runtime s…7.5
• CVE-2023-26471XWiki Platform is a generic wiki platform. Starting in versi…8.8
• CVE-2023-26472XWiki Platform is a generic wiki platform. Starting in versi…8.8
• CVE-2023-26473XWiki Platform is a generic wiki platform. Starting in versi…6.5
• CVE-2023-26474XWiki Platform is a generic wiki platform. Starting in versi…8.8
• CVE-2023-26476XWiki Platform is a generic wiki platform. Starting in versi…7.5
• CVE-2023-26477XWiki Platform is a generic wiki platform. Starting in versi…9.8
• CVE-2023-26478XWiki Platform is a generic wiki platform. Starting in versi…8.1
• CVE-2023-26479XWiki Platform is a generic wiki platform. Starting in versi…6.5
• CVE-2023-2648A vulnerability was found in Weaver E-Office 9.5. It has bee…9.8
• CVE-2023-26480XWiki Platform is a generic wiki platform. Starting in versi…5.4