NIST deprecates RSA-2048 from 2030. Find every one of them before attackers do.
☕
☕ Maven
Not in CISA KEV
CRITICAL severity

XWiki vulnerable to Code Injection in template provider administrationGHSA-9j36-3cp4-rh4j

CRITICALFix: xwiki/xwiki-platform@7bf7094

GHSA-9j36-3cp4-rh4j is a critical-severity (CVSS 9.9) CWE-74 vulnerability in org.xwiki.platform.applications:xwiki-application-administration. 2 public exploit or proof-of-concept references are indexed, so weaponization risk is real. A fix is available for org.xwiki.platform.applications:xwiki-application-administration — see the affected versions and patch details below.

Also known asCVE-2023-29514
Published
Updated
Affected
5 pkgs
Patched
3 / 5
Exploits
2 known
Exploitation data as of Nov 2, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

Exploitation Status

Proof-of-concept exploit code exists

  • CISA’s SSVC triage found public proof-of-concept exploit code for this CVE, though no confirmed active exploitation.
  • A successful exploit gives an attacker total control of the affected component, not partial access.

Exploitation and automatability from CISA’s SSVC triage for GHSA-9j36-3cp4-rh4j.

EPSS Exploitation Probability

via FIRST.org ↗
1.9%probability of exploitation in next 30 days
Lower Risk0.00%
Lower risk than most CVEs79th percentile — riskier than 79% of all scored CVEsHighest risk
0.00%12.9%25.8%38.7%30.2%1.9%May 26Sep 26Nov 26

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

How urgent is this, really

Where this sits among everything scored

Real-World Exposure

5 pkgs affected
☕org.xwiki.platform.applications:xwiki-application-administration☕org.xwiki.platform:xwiki-platform-administration☕org.xwiki.platform:xwiki-platform-administration-ui☕org.xwiki.platform:xwiki-platform-administration-ui☕org.xwiki.platform:xwiki-platform-administration-ui

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Maven packages — download data is not available via public APIs for these ecosystems.

Description

Impact

Any user with edit rights on any document (e.g., the own user profile) can execute code with programming rights, leading to remote code execution by following these steps:

  1. Set the title of any document you can edit (can be the user profile) to
    {{async async="true" cached="false" context="doc.reference"}}{{groovy}}println("Hello " + "from groovy!"){{/groovy}}{{/async}}
  1. Use the object editor to add an object of type XWiki.TemplateProviderClass (named "Template Provider Class") to that document.
  2. Go to another document you can view (can be the home page) and append ?sheet=XWiki.AdminTemplatesSheet to the URL.

When the attack is successful, a template with name "Hello from groovy!" is displayed in the list while on fixed systems, the full title should be displayed.

Patches

This vulnerability has been patched in XWiki 13.10.11, 14.4.8, 14.10.1 and 15.0 RC1.

Workarounds

The vulnerability can be fixed by patching the code in the affected XWiki document as shown in the patch.

References

For more information

If you have any questions or comments about this advisory:

Affected Packages

5 total 3 fixed
EcosystemPackageVulnerable rangeFix
☕Mavenorg.xwiki.platform.applications:xwiki-application-administration≥ 1.35No fix
☕Mavenorg.xwiki.platform:xwiki-platform-administration≥ 3.1-milestone-1No fix
☕Mavenorg.xwiki.platform:xwiki-platform-administration-ui≥ 4.2-milestone-1&&< 13.10.1113.10.11org.xwiki.platform:xwiki-platform-administration-ui:13.10.11
☕Mavenorg.xwiki.platform:xwiki-platform-administration-ui≥ 14.0-rc-1&&< 14.4.814.4.8org.xwiki.platform:xwiki-platform-administration-ui:14.4.8
☕Mavenorg.xwiki.platform:xwiki-platform-administration-ui≥ 14.5&&< 14.10.114.10.1org.xwiki.platform:xwiki-platform-administration-ui:14.10.1

Affected Products

1 product · 3 configurations
Application
xwikixwiki
≥ 14.5 && < 14.10.1
range
Exploits & PoCs
2

Research use only. For defensive security, authorized penetration testing, and academic research only. Never execute exploit code against systems without explicit written authorization.

XWiki Platform is a generic wiki platform offering runtime services for …

github.comNVDApr 2023

Report on jira.xwiki.org

jira.xwiki.orgNVDApr 2023

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for org.xwiki.platform.applications:xwiki-application-administration, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    A fix is available for GHSA-9j36-3cp4-rh4j; check the affected-versions list above or the advisory for the patched release of org.xwiki.platform.applications:xwiki-application-administration, then make sure no transitive dependency still pins the vulnerable range.

  3. Workarounds

    If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

Frequently Asked Questions

### Impact Any user with edit rights on any document (e.g., the own user profile) can execute code with programming rights, leading to remote code execution by following these steps: 1. Set the title of any document you can edit (can be the user profile) to ``` {{async async="true" cached="false" context="doc.reference"}}{{groovy}}println("Hello " + "from groovy!"){{/groovy}}{{/async}} ``` 2. Use the object editor to add an object of type `XWiki.TemplateProviderClass` (named "Template Provider Class") to that document. 3. Go to another document you can view (can be the home page) and app
O3 Security · Impact-Aware SCA

Is GHSA-9j36-3cp4-rh4j in your dependencies?

Find it across Maven, including transitive dependencies.

Scan my dependencies How O3 SCA works
XWiki vulnerable to Code Injection in template provider…