CVE-2023-27479

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions any user with view rights can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation. The root cause is improper escaping of UIX parameters. A proof of concept exploit is to log in, add an `XWiki.UIExtensionClass` xobject to the user profile page, with an Extension Parameters content containing `label={{/html}} {{async async="true" cached="false" context="doc.reference"}}{{groovy}}println("Hello " + "from groovy!"){{/groovy}}{{/async}}`. Then, navigating to `PanelsCode.ApplicationsPanelConfigurationSheet` (i.e., `<xwiki-host>/xwiki/bin/view/PanelsCode/ApplicationsPanelConfigurationSheet` where `<xwiki-host>` is the URL of your XWiki installation) should not execute the Groovy script. If it does, you will see `Hello from groovy!` displayed on the screen. This vulnerability has been patched in XWiki 13.10.11, 14.4.7 and 14.10-rc-1. Users are advised to upgrade. For users unable to upgrade the issue can be fixed by editing the `PanelsCode.ApplicationsPanelConfigurationSheet` wiki page and making the same modifications as shown in commit `6de5442f3c`.

• CWE-74

• https://github.com/xwiki/xwiki-platform/commit/6de5442f3c91c3634a66c7b458d5b142e1c2a2dcPatch
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-qxjg-jhgw-qhrvExploit, Patch, Vendor Advisory
• https://jira.xwiki.org/browse/XWIKI-20294Exploit, Issue Tracking, Patch, Vendor Advisory
• https://github.com/xwiki/xwiki-platform/commit/6de5442f3c91c3634a66c7b458d5b142e1c2a2dcPatch
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-qxjg-jhgw-qhrvExploit, Patch, Vendor Advisory
• https://jira.xwiki.org/browse/XWIKI-20294Exploit, Issue Tracking, Patch, Vendor Advisory

Published

Mar 7, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-27472 quickentity-editor-next is an open source, system local, vi…6.1
• CVE-2023-27474Directus is a real-time API and App dashboard for managing S…5.4
• CVE-2023-27475Goutil is a collection of miscellaneous functionality for th…8.8
• CVE-2023-27476OWSLib is a Python package for client programming with Open …7.5
• CVE-2023-27477wasmtime is a fast and secure runtime for WebAssembly. Wasmt…4.3
• CVE-2023-27478libmemcached-awesome is an open source C/C++ client library …6.5
• CVE-2023-27480XWiki Platform is a generic wiki platform offering runtime s…7.7
• CVE-2023-27481Directus is a real-time API and App dashboard for managing S…4.3
• CVE-2023-27482homeassistant is an open source home automation tool. A remo…10
• CVE-2023-27483crossplane-runtime is a set of go libraries used to build Ku…7.5
• CVE-2023-27484crossplane-runtime is a set of go libraries used to build Ku…4.9
• CVE-2023-27485thmmniii/fbs-core is an open source feedback system for stud…4.3