CVE-2023-26056: XWiki Platform allows macro execution as any user without programming rights through the context macro
XWiki Platform is a generic wiki platform. Starting in version 3.0-milestone-1, it's possible to execute a script with the right of another user, provided the target user does not have programming right. The problem has been patched in XWiki 14.8-rc-1, 14.4.5, and 13.10.10. There are no known workarounds for this issue.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2023-26056?
CVE-2023-26056 is considered a medium severity vulnerability.
How do I fix CVE-2023-26056?
To fix CVE-2023-26056, upgrade XWiki to version 14.8-rc-1 or later, or to versions 14.4.5 or 13.10.10.
What versions of XWiki are affected by CVE-2023-26056?
CVE-2023-26056 affects XWiki versions from 3.0-milestone-1 to below 14.8, inclusive.
What type of vulnerability is CVE-2023-26056?
CVE-2023-26056 is a privilege escalation vulnerability that allows script execution with another user's rights.
Is there a known exploit for CVE-2023-26056?
As of now, there are no known exploits publicly available for CVE-2023-26056.