NIST deprecates RSA-2048 from 2030. Find every one of them before attackers do.
☕
☕ Maven
Not in CISA KEV
CRITICAL severity

CVE-2023-26474 — xwiki-platform-oldcore

CRITICAL

CVE-2023-26474 is a critical-severity (CVSS 9.9) CWE-284 vulnerability in org.xwiki.platform:xwiki-platform-oldcore. 2 public exploit or proof-of-concept references are indexed, so weaponization risk is real. A fix is available for org.xwiki.platform:xwiki-platform-oldcore — see the affected versions and patch details below.

XWiki Platform vulnerable to privilege escalation via properties with wiki syntax that are executed with wrong author

Also known asGHSA-3738-p9x3-mv9r
Published
Updated
Affected
6 pkgs
Patched
6 / 6
Exploits
2 known
Exploitation data as of Nov 5, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

Exploitation Status

No confirmed exploitation observed yet

  • A successful exploit gives an attacker total control of the affected component, not partial access.
  • CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.

Exploitation and automatability from CISA’s SSVC triage for CVE-2023-26474.

EPSS Exploitation Probability

via FIRST.org ↗
0.8%probability of exploitation in next 30 days
Lower Risk0.00%
Lower risk than most CVEs56th percentile — riskier than 56% of all scored CVEsHighest risk
0.29%1.05%1.81%2.57%2.1%0.8%May 26Sep 26Nov 26

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

How urgent is this, really

Where this sits among everything scored

Real-World Exposure

6 pkgs affected
☕org.xwiki.platform:xwiki-platform-oldcore☕org.xwiki.platform:xwiki-platform-legacy-oldcore☕org.xwiki.platform:xwiki-platform-oldcore☕org.xwiki.platform:xwiki-platform-legacy-oldcore☕org.xwiki.platform:xwiki-platform-oldcore☕org.xwiki.platform:xwiki-platform-legacy-oldcore

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Maven packages — download data is not available via public APIs for these ecosystems.

Description

Impact

It's possible to use the right of an existing document content author to execute a text area property.

To reproduce:

  • As an admin with programming rights, create a new user without script or programming right.
  • Login with the freshly created user.
  • Insert the following text in source mode in the about section:
    {{groovy}}println("hello from groovy!"){{/groovy}}
  • Click "Save & View"

Patches

This has been patched in XWiki 14.10, 14.4.7, and 13.10.11.

Workarounds

No known workaround.

References

https://jira.xwiki.org/browse/XWIKI-20373

For more information

If you have any questions or comments about this advisory:

Affected Packages

6 total 6 fixed
EcosystemPackageVulnerable rangeFix
☕Mavenorg.xwiki.platform:xwiki-platform-oldcore≥ 13.10&&< 13.10.1113.10.11org.xwiki.platform:xwiki-platform-oldcore:13.10.11
☕Mavenorg.xwiki.platform:xwiki-platform-legacy-oldcore≥ 13.10&&< 13.10.1113.10.11org.xwiki.platform:xwiki-platform-legacy-oldcore:13.10.11
☕Mavenorg.xwiki.platform:xwiki-platform-oldcore≥ 14.0&&< 14.4.714.4.7org.xwiki.platform:xwiki-platform-oldcore:14.4.7
☕Mavenorg.xwiki.platform:xwiki-platform-legacy-oldcore≥ 14.0&&< 14.4.714.4.7org.xwiki.platform:xwiki-platform-legacy-oldcore:14.4.7
☕Mavenorg.xwiki.platform:xwiki-platform-oldcore≥ 14.5&&< 14.1014.10org.xwiki.platform:xwiki-platform-oldcore:14.10
☕Mavenorg.xwiki.platform:xwiki-platform-legacy-oldcore≥ 14.5&&< 14.1014.10org.xwiki.platform:xwiki-platform-legacy-oldcore:14.10

Affected Products

1 product · 3 configurations
Application
xwikixwiki
≥ 14.5 && < 14.10
range
Exploits & PoCs
2

Research use only. For defensive security, authorized penetration testing, and academic research only. Never execute exploit code against systems without explicit written authorization.

XWiki Platform is a generic wiki platform. Starting in version 13.10, it…

github.comNVDMar 2023

Report on jira.xwiki.org

jira.xwiki.orgNVDMar 2023

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for org.xwiki.platform:xwiki-platform-oldcore, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update org.xwiki.platform:xwiki-platform-oldcore to 13.10.11 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2023-26474 is resolved across your whole dependency graph.

  3. Workarounds

    Put an independent control in front of the weakness: restrict the affected endpoint or interface to trusted networks, require an additional authentication factor or proxy-level check, and invalidate existing sessions and credentials in case the flaw has already been used.

Frequently Asked Questions

### Impact It's possible to use the right of an existing document content author to execute a text area property. To reproduce: * As an admin with programming rights, create a new user without script or programming right. * Login with the freshly created user. * Insert the following text in source mode in the about section: ``` {{groovy}}println("hello from groovy!"){{/groovy}} ``` * Click "Save & View" ### Patches This has been patched in XWiki 14.10, 14.4.7, and 13.10.11. ### Workarounds No known workaround. ### References https://jira.xwiki.org/browse/XWIKI-20373 ### For more i
O3 Security · Impact-Aware SCA

Is CVE-2023-26474 in your dependencies?

Find it across Maven, including transitive dependencies.

Scan my dependencies How O3 SCA works
CVE-2023-26474: xwiki-platform-oldcore — Fixed in 13.10.11