https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-22T14:08:15.945092+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2024-01245 bdu:2024-01245 2026-10-22T14:08:15.948468+00:00 bdu:2024-01245 https://cve.radiocsirt.org/vuln/euvd-2026-213849 EUVD-2026-213849 2026-10-22T14:08:15.948511+00:00 EUVD-2026-213849 https://cve.radiocsirt.org/vuln/fkie_cve-2023-29526 fkie_cve-2023-29526 2026-10-22T14:08:15.948527+00:00

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions it's possible to display or interact with any page a user cannot access through the combination of the async and display macros. A comment with either macro will be executed when viewed providing a code injection vector in the context of the running server. This vulnerability has been patched in XWiki 15.0-rc-1, 14.10.3, 14.4.8, and 13.10.11. Users are advised to upgrade. There are no known workarounds for this issue.

 https://cve.radiocsirt.org/vuln/ghsa-gpq5-7p34-vqx5 GHSA-gpq5-7p34-vqx5 — XWiki Platform's async and display macro allow displaying and interacting with any document in restricted mode 2026-10-22T14:08:15.948559+00:00

Affected: Maven: org.xwiki.platform:xwiki-platform-oldcore, Maven: org.xwiki.platform:xwiki-platform-rendering-async-macro

### Impact

It's possible to display any page you cannot access through the combination of the async and display macro.

Steps to reproduce:

1. Enable comments for guests by giving guests comment rights 2. As a guest, create a comment with content ```{{async}}{{display reference="Menu.WebHome" /}}{{/async}}``` 3. Open the comments viewer from the menu (appends ?viewer=comments to the URL)

-> the `Menu.WebHome` is displayed while the expectation would be to have an error that the current user is not allowed to see it

### Patches

The vulnerability has been patched in XWiki 15.0-rc-1, 14.10.3, 14.4.8, and 13.10.11.

### Workarounds

There is no known workaround.

### References

https://jira.xwiki.org/browse/XWIKI-20394 https://jira.xwiki.org/browse/XRENDERING-694

### For more information

If you have any questions or comments about this advisory: * Open an issue in [Jira XWiki.org](https://jira.xwiki.org/) * Email us at [Security Mailing List](mailto:security@xwiki.org)

 https://cve.radiocsirt.org/vuln/gsd-2023-29526 gsd-2023-29526 2026-10-22T14:08:15.948604+00:00 gsd-2023-29526