Improper Neutralization of Directives in Dynamically Evaluated Code in org.xwiki.platform:xwiki-platform-panels-ui
Description
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions any user with view rights can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation. The root cause is improper escaping of UIX parameters. A proof of concept exploit is to log in, add an XWiki.UIExtensionClass xobject to the user profile page, with an Extension Parameters content containing label={{/html}} {{async async="true" cached="false" context="doc.reference"}}{{groovy}}println("Hello " + "from groovy!"){{/groovy}}{{/async}}. Then, navigating to PanelsCode.ApplicationsPanelConfigurationSheet (i.e., <xwiki-host>/xwiki/bin/view/PanelsCode/ApplicationsPanelConfigurationSheet where <xwiki-host> is the URL of your XWiki installation) should not execute the Groovy script. If it does, you will see Hello from groovy! displayed on the screen. This vulnerability has been patched in XWiki 13.10.11, 14.4.7 and 14.10-rc-1. Users are advised to upgrade. For users unable to upgrade the issue can be fixed by editing the PanelsCode.ApplicationsPanelConfigurationSheet wiki page and making the same modifications as shown in commit 6de5442f3c.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.xwiki.platform:xwiki-platform-panels-uiMaven | >= 6.3-milestone-2, < 13.10.11 | 13.10.11 |
org.xwiki.platform:xwiki-platform-panels-uiMaven | >= 14.0, < 14.4.7 | 14.4.7 |
org.xwiki.platform:xwiki-platform-panels-uiMaven | >= 14.5, < 14.10-rc-1 | 14.10-rc-1 |
Affected products
1- Range: >= 6.3-milestone-2, < 13.10.11
Patches
16de5442f3c91XWIKI-20294: Improve escaping in Applications Panel Configuration sheet
1 file changed · +7 −6
xwiki-platform-core/xwiki-platform-panels/xwiki-platform-panels-ui/src/main/resources/PanelsCode/ApplicationsPanelConfigurationSheet.xml+7 −6 modified@@ -84,14 +84,15 @@ <ul class="nav nav-pills applicationsPanel"> #foreach($app in $apps) #set($params = $app.uix.getParameters()) - #if("$!params.icon" != '' && "$!params.label" != '' && "$!params.target" != '' && $xwiki.hasAccessLevel('view', $xcontext.user, $params.target)) - #if ($params.icon.startsWith('icon:')) - #set($icon = $services.icon.renderHTML($params.icon.substring(5))) + #set($normalizedIcon = $stringtool.substringBefore($!params.icon, ' ')) + #if("$!normalizedIcon" != '' && "$!params.label" != '' && "$!params.target" != '' && $xwiki.hasAccessLevel('view', $xcontext.user, $params.target)) + #if ($normalizedIcon.startsWith('icon:')) + #set($icon = $services.icon.renderHTML($normalizedIcon.substring(5))) #else - #set($icon = $services.rendering.render($services.rendering.parse("image:${params.icon}", 'xwiki/2.1'), 'xhtml/1.0')) + #set($icon = $services.rendering.render($services.rendering.parse("image:${normalizedIcon}", 'xwiki/2.1'), 'xhtml/1.0')) #end - <li class="draggableApp" id="$app.uix.id"> - <a><span class="application-img">$icon </span> <span class="application-label">$params.label</a> + <li class="draggableApp" id="$escapetool.xml($app.uix.id)"> + <a><span class="application-img">$icon </span> <span class="application-label">$escapetool.xml($params.label)</a> </li> #end #end
Vulnerability mechanics
Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
5- github.com/advisories/GHSA-qxjg-jhgw-qhrvghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2023-27479ghsaADVISORY
- github.com/xwiki/xwiki-platform/commit/6de5442f3c91c3634a66c7b458d5b142e1c2a2dcghsax_refsource_MISCWEB
- github.com/xwiki/xwiki-platform/security/advisories/GHSA-qxjg-jhgw-qhrvghsax_refsource_CONFIRMWEB
- jira.xwiki.org/browse/XWIKI-20294ghsax_refsource_MISCWEB
News mentions
0No linked articles in our index yet.