Which products and versions are affected by CVE-2023-46731?

Affected: Xwiki; org.xwiki.platform:xwiki-platform-administration (maven); org.xwiki.platform:xwiki-platform-administration-ui (maven), among others. The full list is in the CVE brief.

Is CVE-2023-46731 being exploited in the wild?

It is not listed in any known-exploited vulnerabilities catalog.

Is CVE-2023-46731 in the CISA KEV catalog?

No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.

Is there a public exploit for CVE-2023-46731?

Public exploit code is available.

How urgently should CVE-2023-46731 be patched?

Brandefense priority: patch immediately, because it is very likely to be exploited soon.

Request A Demo

Vulnerability Intelligence

CVE-2023-46731

CriticalPublic exploit

XWiki Platform vulnerable to remote code execution through the section parameter in Administration as guest

Published Nov 8, 2023 · Updated Sep 10, 2026 · Also known as GHSA-62pr-qqf7-hh89

Key Facts

Patch immediately

CVE-2023-46731 is a critical-severity vulnerability (CVSS 9.8 v3.1) affecting Xwiki, org.xwiki.platform:xwiki-platform-administration (maven), org.xwiki.platform:xwiki-platform-administration-ui (maven) and 1 more product.
It is not listed in any known-exploited vulnerabilities catalog. Public exploit code is available.
EPSS estimates a 89% probability of exploitation in the next 30 days.
Fixed versions are available, including org.xwiki.platform:xwiki-platform-administration 14.10.14, org.xwiki.platform:xwiki-platform-administration-ui 14.10.14, org.xwiki.platform:xwiki-platform-administration-ui 15.5.1.
Brandefense priority: patch immediately, because it is very likely to be exploited soon.

CVSS v3.1

9.8

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS (30-day exploit likelihood)

89%

Higher than 99.7% of all scored CVEs

Exploited in the wild

No known

Not in a known-exploited catalog

Public exploit code

Available

Proof-of-concept or weaponized module

Get the full CVE-2023-46731 brief as a PDF

Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.

Description

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. XWiki doesn't properly escape the section URL parameter that is used in the code for displaying administration sections. This allows any user with read access to the document XWiki.AdminSheet (by default, everyone including unauthenticated users) to execute code including Groovy code. This impacts the confidentiality, integrity and availability of the whole XWiki instance. This vulnerability has been patched in XWiki 14.10.14, 15.6 RC1 and 15.5.1. Users are advised to upgrade. Users unablr to upgrade may apply the fix in commit fec8e0e53f9 manually. Alternatively, to protect against attacks from unauthenticated users, view right for guests can be removed from this document (it is only needed for space and wiki admins).

Affected Products

4 affected entries in total

Product	Affected versions	Fixed in
XwikiXwiki	See advisory	14.10.14
org.xwiki.platform:xwiki-platform-administrationmaven	See advisory	14.10.14
org.xwiki.platform:xwiki-platform-administration-uimaven	See advisory	15.5.1
xwiki-platform	>= org.xwiki.platform:xwiki-platform-administration : < 14.10.14	n/a

Patched Releases

org.xwiki.platform:xwiki-platform-administration

14.10.14

org.xwiki.platform:xwiki-platform-administration-ui

14.10.14, 15.5.1

Xwiki

14.10.14

Timeline

Publicly disclosed
Nov 8, 2023
Last updated
Sep 10, 2026

Weakness Type

CWE-94 Improper Control of Generation of Code ('Code Injection')
CWE-95 Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')

References

3 more references in the full CVE brief

FAQ

Common Questions.

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it.
Affected: Xwiki; org.xwiki.platform:xwiki-platform-administration (maven); org.xwiki.platform:xwiki-platform-administration-ui (maven), among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
Public exploit code is available.
Fixed versions are available, including org.xwiki.platform:xwiki-platform-administration 14.10.14, org.xwiki.platform:xwiki-platform-administration-ui 14.10.14, org.xwiki.platform:xwiki-platform-administration-ui 15.5.1.
Brandefense priority: patch immediately, because it is very likely to be exploited soon.

Is CVE-2023-46731 Running On Your Attack Surface?

Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.