CVE-2023-26477
Criticalorg.xwiki.platform:xwiki-platform-flamingo-theme-ui Eval Injection vulnerability
Published Mar 3, 2023 · Updated Sep 10, 2026 · Also known as GHSA-x2qm-r4wx-8gpg
Key Facts
Patch immediately- CVE-2023-26477 is a critical-severity vulnerability (CVSS 9.8 v3.1) affecting Xwiki, org.xwiki.platform:xwiki-platform-flamingo-theme-ui (maven), xwiki-platform.
- It is not listed in any known-exploited vulnerabilities catalog. No public exploit code is known.
- EPSS estimates a 75% probability of exploitation in the next 30 days.
- Fixed versions are available, including org.xwiki.platform:xwiki-platform-flamingo-theme-ui 13.10.10, org.xwiki.platform:xwiki-platform-flamingo-theme-ui 14.4.6, org.xwiki.platform:xwiki-platform-flamingo-theme-ui 14.9-rc-1.
- Brandefense priority: patch immediately, because it is very likely to be exploited soon.
CVSS v3.1
9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS (30-day exploit likelihood)
75%
Higher than 99.5% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
None known
Get the full CVE-2023-26477 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
XWiki Platform is a generic wiki platform. Starting in versions 6.3-rc-1 and 6.2.4, it's possible to inject arbitrary wiki syntax including Groovy, Python and Velocity script macros via the newThemeName request parameter (URL parameter), in combination with additional parameters. This has been patched in the supported versions 13.10.10, 14.9-rc-1, and 14.4.6. As a workaround, it is possible to edit FlamingoThemesCode.WebHomeSheet and manually perform the changes from the patch fixing the issue.
Affected Products
3 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| XwikiXwiki | See advisory | 13.10.10 |
| org.xwiki.platform:xwiki-platform-flamingo-theme-uimaven | >= 6.2.4 | 14.9-rc-1 |
| xwiki-platform | >= >= 6.2.4, < 13.10.10 | n/a |
Patched Releases
org.xwiki.platform:xwiki-platform-flamingo-theme-ui
13.10.10, 14.4.6, 14.9-rc-1
Xwiki
13.10.10
Timeline
Publicly disclosed
Mar 3, 2023
Last updated
Sep 10, 2026
Weakness Type
- CWE-94 Improper Control of Generation of Code ('Code Injection')
- CWE-95 Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')
References
- advisoryGHSA advisory
- advisoryhttps://github.com/CVEProject/cvelistV5/tree/main/cves/2023/26xxx/CVE-2023-26477.json
- advisoryhttps://nvd.nist.gov/vuln/detail/CVE-2023-26477
- patchhttps://github.com/xwiki/xwiki-platform/commit/ea2e615f50a918802fd60b09ec87aa04bc6ea8e2#diff-e2153fa59f9d92ef67b0afbf27984bd17170921a3b558fac227160003d0dfd2aR283-R284
- exploithttps://github.com/xwiki/xwiki-platform/security/advisories/GHSA-x2qm-r4wx-8gpg
FAQ
Common Questions.
XWiki Platform is a generic wiki platform.
Affected: Xwiki; org.xwiki.platform:xwiki-platform-flamingo-theme-ui (maven) versions >= 6.2.4; xwiki-platform versions >= >= 6.2.4, < 13.10.10. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
No public exploit code is known.
Fixed versions are available, including org.xwiki.platform:xwiki-platform-flamingo-theme-ui 13.10.10, org.xwiki.platform:xwiki-platform-flamingo-theme-ui 14.4.6, org.xwiki.platform:xwiki-platform-flamingo-theme-ui 14.9-rc-1.
Brandefense priority: patch immediately, because it is very likely to be exploited soon.
Is CVE-2023-26477 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo