https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 19 Oct 2026 12:29:33 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-214066 EUVD-2026-214066 https://cve.radiocsirt.org/vuln/euvd-2026-214066 https://cve.radiocsirt.org/vuln/fkie_cve-2023-29521 <p>XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with view rights can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation. The root cause is improper escaping of `Macro.VFSTreeMacro`. This page is not installed by default.This vulnerability has been patched in XWiki 15.0-rc-1, 14.10.2, 14.4.8, 13.10.11. Users are advised to upgrade. There are no known workarounds for this vulnerability.</p> <p>XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with view rights can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation. The root cause is improper escaping of `Macro.VFSTreeMacro`. This page is not installed by default.This vulnerability has been patched in XWiki 15.0-rc-1, 14.10.2, 14.4.8, 13.10.11. Users are advised to upgrade. There are no known workarounds for this vulnerability.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2023-29521 https://cve.radiocsirt.org/vuln/ghsa-p67q-h88v-5jgr <p><strong>Affected:</strong> Maven: org.xwiki.platform:xwiki-platform-vfs-ui</p> <p>### Impact Any user with view rights can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation. The root cause is improper escaping of `Macro.VFSTreeMacro`. This page is not installed by default.</p> <p>See https://jira.xwiki.org/browse/XWIKI-20260 for the reproduction steps.</p> <p>### Patches The vulnerability has been patched in XWiki 15.0-rc-1, 14.10.2, 14.4.8, 13.10.11.</p> <p>### Workarounds The issue can be fixed by applying this [patch](https://github.com/xwiki/xwiki-platform/commit/fad02328f5ec7ab7fe5b932ffb5bc5c1ba7a5b12) on `Macro.VFSTreeMacro`.</p> <p>### References - https://jira.xwiki.org/browse/XWIKI-20260 - https://github.com/xwiki/xwiki-platform/commit/fad02328f5ec7ab7fe5b932ffb5bc5c1ba7a5b12</p> <p>### For more information</p> <p>If you have any questions or comments about this advisory:</p> <p>* Open an issue in [Jira XWiki.org](https://jira.xwiki.org/) * Email us at [Security Mailing List](mailto:security@xwiki.org)</p> <p><strong>Affected:</strong> Maven: org.xwiki.platform:xwiki-platform-vfs-ui</p> <p>### Impact Any user with view rights can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation. The root cause is improper escaping of `Macro.VFSTreeMacro`. This page is not installed by default.</p> <p>See https://jira.xwiki.org/browse/XWIKI-20260 for the reproduction steps.</p> <p>### Patches The vulnerability has been patched in XWiki 15.0-rc-1, 14.10.2, 14.4.8, 13.10.11.</p> <p>### Workarounds The issue can be fixed by applying this [patch](https://github.com/xwiki/xwiki-platform/commit/fad02328f5ec7ab7fe5b932ffb5bc5c1ba7a5b12) on `Macro.VFSTreeMacro`.</p> <p>### References - https://jira.xwiki.org/browse/XWIKI-20260 - https://github.com/xwiki/xwiki-platform/commit/fad02328f5ec7ab7fe5b932ffb5bc5c1ba7a5b12</p> <p>### For more information</p> <p>If you have any questions or comments about this advisory:</p> <p>* Open an issue in [Jira XWiki.org](https://jira.xwiki.org/) * Email us at [Security Mailing List](mailto:security@xwiki.org)</p> https://cve.radiocsirt.org/vuln/ghsa-p67q-h88v-5jgr https://cve.radiocsirt.org/vuln/gsd-2023-29521 gsd-2023-29521 https://cve.radiocsirt.org/vuln/gsd-2023-29521