CVE-2023-26055

CRITICAL

XWiki Commons are technical libraries common to several other top level XWiki projects. Starting in version 3.1-milestone-1, any user can edit their own profile and inject code, which is going to b...

Affects 1 product across 1 vendor.

CVSS 3.19.9
EPSS1.2%
Percentile67th
PatchUnknown
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, low privileges required, no user interaction needed, can impact systems beyond the vulnerable component, full confidentiality impact, full integrity impact, full availability impact.
CWE Weakness Definitions
CWE-150: CWE-150
Related Attack Patterns (CAPEC)
CAPEC-41 Using Meta-characters in E-mail Headers to Inject Malicious Payloads
via CWE-150
CAPEC-81 Web Server Logs Tampering
via CWE-150
CAPEC-93 Log Injection-Tampering-Forging
via CWE-150
CAPEC-134 Email Injection
via CWE-150

Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.

◆ AI Analysis — automated analysis, not human-reviewed

CVE-2023-26055 affects XWiki Commons starting from version 3.1-milestone-1, allowing any user to inject code into their profile and other short text properties, which is executed with programming rights.

BSID: BS-2023-GLOBAL-061117-C • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: HIGH

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2023-26055?
CVE-2023-26055 affects XWiki Commons starting from version 3.1-milestone-1, allowing any user to inject code into their profile and other short text properties, which is executed with programming rights.
What is the CVSS score for CVE-2023-26055?
CVE-2023-26055 has CVSS 9.9 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS: 1.2%.
Is CVE-2023-26055 actively exploited?
No confirmed active exploitation of CVE-2023-26055 as of 2026-09-25.
How do I remediate CVE-2023-26055?
Priority: IMMEDIATE. Advisory: https://jira.xwiki.org/browse/XCOMMONS-2498 PSIRT: [email protected]
What systems are affected by CVE-2023-26055?
CVE-2023-26055 affects Xwiki Commons.
Vulnerability Details
CVE IDCVE-2023-26055
BSIDBS-2023-GLOBAL-061117-C BreachSpider Global ID
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Published2023-03-02
Last Modified2026-06-17
ICS Relevance0%
Weakness (CWE)
CWE-150
SourceNVD
Official Description

XWiki Commons are technical libraries common to several other top level XWiki projects. Starting in version 3.1-milestone-1, any user can edit their own profile and inject code, which is going to be executed with programming right. The same vulnerability can also be exploited in all other places where short text properties are displayed, e.g., in apps created using Apps Within Minutes that use a short text field. The problem has been patched on versions 13.10.9, 14.4.4, 14.7RC1.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

The vulnerability arises from improper validation of user input in profile editing and other short text properties, enabling code injection that executes with elevated privileges.

Exploitation Likelihood: CRITICAL

Affected Products
VendorProductAffected Versions
Xwiki Commons 3.1 3.1.1 ≥ 3.2, < 13.10.9 ≥ 14.4, < 14.4.4 ≥ 14.5, < 14.7
Remediation
View Vendor Advisory →

Remediation Priority: IMMEDIATE

Vendor PSIRT: [email protected]
Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 1323 Days
CISA known-exploitedNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
AI Enrichment Record — provenance & audit hash
Model/workspace/models/qwen2.5-coder-32b-instruct-bf16
ConfidenceHIGH
Enriched At2026-05-24
SHA-512 Audit Hash81047fa60947743f0e81ae8ad25b33db166fc60d2e459d15945f3d8ad786d5f4b5d2bd0db049e23ded6eb6adfae5e15d8a904c930519b0d42c0bc606ee1073ef
Related CVEs affecting Xwiki
CVE-2025-65091 10.0 XWiki Full Calendar Macro displays objects from the wiki on the calendar. Pri... CVE-2025-55729 10.0 XWiki Remote Macros provides XWiki rendering macros that are useful when migr... CVE-2025-55730 10.0 XWiki Remote Macros provides XWiki rendering macros that are useful when migr... CVE-2023-27479 9.9 XWiki Platform is a generic wiki platform offering runtime services for appli... CVE-2023-46731 9.8 XWiki Platform is a generic wiki platform offering runtime services for appli...
View all Xwiki CVEs →

Critical Severity - Know Your Exposure

A CVSS 9.9 vulnerability in your ICS environment cannot wait. BreachSpider maps critical CVEs to your specific assets and tells you what to fix first.

Create a free account →