Critical severity9.9NVD Advisory· Published Mar 2, 2023· Updated Jun 17, 2026
CVE-2023-26055
CVE-2023-26055
Description
XWiki Commons are technical libraries common to several other top level XWiki projects. Starting in version 3.1-milestone-1, any user can edit their own profile and inject code, which is going to be executed with programming right. The same vulnerability can also be exploited in all other places where short text properties are displayed, e.g., in apps created using Apps Within Minutes that use a short text field. The problem has been patched on versions 13.10.9, 14.4.4, 14.7RC1.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.xwiki.commons:xwiki-commons-xmlMaven | >= 3.1-milestone-1, < 13.10.9 | 13.10.9 |
org.xwiki.commons:xwiki-commons-xmlMaven | >= 14.0-rc-1, < 14.4.4 | 14.4.4 |
org.xwiki.commons:xwiki-commons-xmlMaven | >= 14.5, < 14.7-rc-1 | 14.7-rc-1 |
Affected products
7cpe:2.3:a:xwiki:commons:*:*:*:*:*:*:*:*+ 4 more
- cpe:2.3:a:xwiki:commons:*:*:*:*:*:*:*:*range: >=3.2,<13.10.9
- cpe:2.3:a:xwiki:commons:14.4:rc1:*:*:*:*:*:*
- cpe:2.3:a:xwiki:commons:3.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:xwiki:commons:3.1:milestone1:*:*:*:*:*:*
- cpe:2.3:a:xwiki:commons:3.1:milestone2:*:*:*:*:*:*
- Range: >= 3.1-milestone-1, < 13.10.9
Patches
Vulnerability mechanics
References
6- jira.xwiki.org/browse/XCOMMONS-2498nvdIssue TrackingPatchVendor AdvisoryWEB
- github.com/xwiki/xwiki-commons/security/advisories/GHSA-8cw6-4r32-6r3hnvdExploitVendor AdvisoryWEB
- jira.xwiki.org/browse/XWIKI-19793nvdExploitIssue TrackingPatchVendor AdvisoryWEB
- jira.xwiki.org/browse/XWIKI-19794nvdExploitIssue TrackingPatchVendor AdvisoryWEB
- github.com/advisories/GHSA-8cw6-4r32-6r3hghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2023-26055ghsaADVISORY
News mentions
0No linked articles in our index yet.