Medium severity5.3NVD Advisory· Published Apr 14, 2023· Updated Jun 17, 2026

CVE-2023-26559

Description

A directory traversal vulnerability in Oxygen XML Web Author before 25.0.0.3 build 2023021715 and Oxygen Content Fusion before 5.0.3 build 2023022015 allows an attacker to read files from a WEB-INF directory via a crafted HTTP request. (XML Web Author 24.1.0.3 build 2023021714 and 23.1.1.4 build 2023021715 are also fixed versions.)

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Sync/Oxygen Content Fusion
cpe:2.3:a:sync:oxygen_content_fusion:*:*:*:*:*:*:*:*
Range: <5.0.3
Sync/Oxygen XML Web Author
cpe:2.3:a:sync:oxygen_xml_web_author:*:*:*:*:*:*:*:*
Range: <23.1.1.4
Oxygen/XML Web Authordescription
Oxygen/XML Web Authorllm-fuzzy
Range: <25.0.0.3 build 2023021715, >=24.1.0.3 build 2023021714, >=23.1.1.4 build 2023021715
Oxygen/Content Fusionllm-fuzzy
Range: <5.0.3 build 2023022015

Patches

Vulnerability mechanics

References

www.oxygenxml.com/security/advisory/SYNC-2023-042301.htmlnvdMitigationVendor Advisory
oxygenxml.comnvdProduct

News mentions

No linked articles in our index yet.

cvss	0.345
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000