Cyber Resilience

CVE-2023-26055

Xwiki Commons 3.2 – 13.10.9

Public PoC
Published
02 March 2023
Modified
21 November 2024
Patch / advisory
CVSS Score v3.1 9.9
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
EPSS Score 0.012 64th percentile
Risk Priority 75 floored blend · peak EPSS

Summary

CVE-2023-26055 is a critical-severity Improper Neutralization of Escape, Meta, or Control Sequences (CWE-150) vulnerability in Xwiki Commons. Its CVSS base score is 9.9 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Content Injection (T1659); ranked in the top 36% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

XWiki Commons, the shared technical libraries used across multiple XWiki projects, contain an improper neutralization flaw (CWE-150) that permits stored code injection. The issue affects all versions starting from 3.1-milestone-1 and manifests when short text properties are rendered, including user profile pages and any application built with Apps Within Minutes that employs a short text field.

Any authenticated user with permission to edit their own profile or comparable short text fields can supply malicious code that executes with programming rights. Because the vulnerability is exploitable over the network with low attack complexity and no user interaction, an attacker can achieve full confidentiality, integrity, and availability impact within the affected XWiki instance, including scope change to other components.

Public advisories hosted on GitHub and the corresponding XWiki JIRA issues (XCOMMONS-2498, XWIKI-19793, XWIKI-19794) state that the flaw is resolved in releases 13.10.9, 14.4.4, and 14.7RC1; administrators are advised to upgrade to one of these versions.

EPSS scores have remained low, moving only from a peak of 0.0505 to a current value of 0.0490, indicating limited observed exploitation interest since disclosure.

EU & UK References

Vulnerability Data

XWiki Commons are technical libraries common to several other top level XWiki projects. Starting in version 3.1-milestone-1, any user can edit their own profile and inject code, which is going to be executed with programming right. The same vulnerability can…

more

also be exploited in all other places where short text properties are displayed, e.g., in apps created using Apps Within Minutes that use a short text field. The problem has been patched on versions 13.10.9, 14.4.4, 14.7RC1.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise Techniques

T1659 Content Injection Initial Access
Adversaries may gain access and continuously communicate with victims by injecting malicious content into systems through online network traffic.
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2023-29528Same product: Xwiki Commons
CVE-2023-36471Same product: Xwiki Commons
CVE-2023-35158Same vendor: Xwiki
CVE-2026-21439Shared CWE-150
CVE-2026-40505Shared CWE-150
CVE-2025-65082Shared CWE-150
CVE-2023-3265Shared CWE-150
CVE-2023-39342Shared CWE-150
CVE-2025-64494Shared CWE-150
CVE-2024-47252Shared CWE-150

Affected Assets

xwiki
commons
14.4, 3.1, 3.1.1 · 3.2 — 13.10.9 · 14.4 — 14.4.4 · 14.5 — 14.7

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

Detect
Catch it (NIST detect / respond)

Harden
Shrink the surface (DISA STIG)

Validate
Prove the fix (OWASP ASVS)
  • V1.2.10
  • V1.3.12

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC practices directly require input neutralization and escaping to prevent this class of flaw.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

finds

Security testing can detect the weakness but does not itself implement neutralization.

prevents

Secure development lifecycle mandates input validation and output encoding that directly neutralizes escape/meta sequences.

prevents

Application security requirements explicitly call for controls against injection and malformed input sequences.

prevents

Secure architecture principles reduce attack surface but do not prescribe specific neutralization techniques.

prevents

Secure coding standards require proper escaping and neutralization of control characters before downstream processing.

References