CVE-2023-26055— XWiki Commons may allow privilege escalation to programming rights via user's first name
Quick assessment
Affected
xwiki xwiki-commons
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
XWiki Commons是其他几个顶级 XWiki 项目共有的技术库。 XWiki Commons存在安全漏洞，该漏洞源于任何用户都可以编辑自己的配置文件并注入代码，这些代码将以编程权限执行。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2023-26055
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
XWiki Commons may allow privilege escalation to programming rights via user's first name
Source: CVE Program / CVE List V5
Vulnerability Description
XWiki Commons are technical libraries common to several other top level XWiki projects. Starting in version 3.1-milestone-1, any user can edit their own profile and inject code, which is going to be executed with programming right. The same vulnerability can also be exploited in all other places where short text properties are displayed, e.g., in apps created using Apps Within Minutes that use a short text field. The problem has been patched on versions 13.10.9, 14.4.4, 14.7RC1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
转义、元或控制序列转义处理不恰当
Source: CVE Program / CVE List V5
Vulnerability Title
XWiki Commons 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
XWiki Commons是其他几个顶级 XWiki 项目共有的技术库。 XWiki Commons存在安全漏洞，该漏洞源于任何用户都可以编辑自己的配置文件并注入代码，这些代码将以编程权限执行。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| xwiki | xwiki-commons | >= 3.1-milestone-1, < 13.10.9 | - |
|
II. Public POCs for CVE-2023-26055
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2023-26055
请登录查看更多情报信息。
Vendor Advisories for CVE-2023-26055 (1)
-
https://github.com/xwiki/xwiki-commons/security/advisories/GHSA-8cw6-4r32-6r3h x_refsource_CONFIRM
Other References for CVE-2023-26055 (3)
-
https://jira.xwiki.org/browse/XWIKI-19793 x_refsource_MISC
-
https://jira.xwiki.org/browse/XWIKI-19794 x_refsource_MISC
-
https://jira.xwiki.org/browse/XCOMMONS-2498 x_refsource_MISC
Same Patch Batch · xwiki · 2023-03-02 · 13 CVEs total
| CVE-2023-26471 | 10.0 CRITICAL | XWiki Platform users may execute anything with superadmin right through comments and async |
| CVE-2023-26472 | 10.0 CRITICAL | XWiki Platform vulnerable to privilege escalation via async macro and IconThemeSheet from |
| CVE-2023-26474 | 10.0 CRITICAL | XWiki Platform vulnerable to privilege escalation via properties with wiki syntax that are |
| CVE-2023-26475 | 10.0 CRITICAL | XWiki Platform vulnerable to Remote Code Execution in Annotations |
| CVE-2023-26477 | 10.0 CRITICAL | org.xwiki.platform:xwiki-platform-flamingo-theme-ui Eval Injection vulnerability |
| CVE-2023-26480 | 8.9 HIGH | XWiki-Platform vulnerable to stored Cross-site Scripting via the HTML displayer in Live Da |
| CVE-2023-26476 | 7.5 HIGH | Two XWiki Platform UIs Expose Sensitive Information to an Unauthorized Actor |
| CVE-2023-26478 | 6.6 MEDIUM | org.xwiki.platform:xwiki-platform-store-filesystem-oldcore has Exposed Dangerous Method or |
| CVE-2023-26473 | 6.5 MEDIUM | XWiki Platform allows unprivileged users to make arbitrary select queries using DatabaseLi |
| CVE-2023-26479 | 6.5 MEDIUM | org.xwiki.platform:xwiki-platform-rendering-parser vulnerable to Improper Handling of Exce |
| CVE-2023-26470 | 5.7 MEDIUM | In XWiki Platform, saving a document with a large object number leads to persistent OOM er |
| CVE-2023-26056 | 5.4 MEDIUM | XWiki Platform allows macro execution as any user without programming rights through the c |
IV. Related Vulnerabilities
Same product: xwiki-commons
-
CVE-2026-23734
XWiki Platform: Path traversal via resources parameter in ss -
CVE-2024-31996
XWiki Commons missing escaping of `{` in Velocity escapetool -
CVE-2023-36471
HTML sanitizer allows form elements in restricted in org.xwi -
CVE-2023-31126
Improper Neutralization of Invalid Characters in Data Attrib -
CVE-2023-29528
Cross-site Scripting in org.xwiki.commons:xwiki-commons-xml
Same vendor: xwiki
-
CVE-2025-53837
org.xwiki.rendering:xwiki-rendering-xml has an Eval Injectio -
CVE-2026-53966
XWiki Platform: Privilege escalation from edit to script rig -
CVE-2026-34151
XWiki Platform: Resource path traversal via /skin/ action en -
CVE-2026-48048
XWiki Platform's Livetable results still allow reconstructin -
CVE-2026-48047
XWiki Platform vulnerable to potential arbitrary file writin
Same weakness: CWE-150
-
CVE-2026-103431
Collectl: collectl: colmux does not sanitize ansi/vt100 term -
CVE-2026-102601
Flysystem: WhitespacePathNormalizer's control-character (Cor -
CVE-2026-100867
spaceship-prompt through 4.22.5 Terminal Escape Sequence Inj -
CVE-2026-100866
onefetch through 2.28.1 Terminal Escape Sequence Injection -
CVE-2026-90773
procs through 0.14.12 Terminal Escape Sequence Injection via
V. Comments for CVE-2023-26055
No comments yet