https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 10 Oct 2026 08:26:34 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-220971 EUVD-2026-220971 https://cve.radiocsirt.org/vuln/euvd-2026-220971 https://cve.radiocsirt.org/vuln/fkie_cve-2023-26472 <p>XWiki Platform is a generic wiki platform. Starting in version 6.2-milestone-1, one can execute any wiki content with the right of IconThemeSheet author by creating an icon theme with certain content. This can be done by creating a new page or even through the user profile for users not having edit right. The issue has been patched in XWiki 14.9, 14.4.6, and 13.10.10. An available workaround is to fix the bug in the page `IconThemesCode.IconThemeSheet` by applying a modification from commit 48caf7491595238af2b531026a614221d5d61f38.</p> <p>XWiki Platform is a generic wiki platform. Starting in version 6.2-milestone-1, one can execute any wiki content with the right of IconThemeSheet author by creating an icon theme with certain content. This can be done by creating a new page or even through the user profile for users not having edit right. The issue has been patched in XWiki 14.9, 14.4.6, and 13.10.10. An available workaround is to fix the bug in the page `IconThemesCode.IconThemeSheet` by applying a modification from commit 48caf7491595238af2b531026a614221d5d61f38.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2023-26472 https://cve.radiocsirt.org/vuln/ghsa-vwr6-qp4q-2wj7 <p><strong>Affected:</strong> Maven: org.xwiki.platform:xwiki-platform-icon-ui</p> <p>### Impact</p> <p>One can execute any wiki content with the right of IconThemeSheet author by creating an icon theme with the following content:</p> <p>``` }}} {{async async=&#34;true&#34;}} {{groovy}} println(&#34;Hello from Groovy!&#34;) {{/groovy}} {{/async}} {{{ ```</p> <p>Can be done by creating a new page or even through the user profile for users not having edit right.</p> <p>### Patches</p> <p>This has been patched in XWiki 14.9, 14.4.6, and 13.10.10.</p> <p>### Workarounds</p> <p>An easy workaround is to actually fix the bug in the page `IconThemesCode.IconThemeSheet` by applying the following modification: https://github.com/xwiki/xwiki-platform/commit/48caf7491595238af2b531026a614221d5d61f38#diff-2ec9d716673ee049937219cdb0a92e520f81da14ea84d144504b97ab2bdae243R45</p> <p>### References</p> <p>https://jira.xwiki.org/browse/XWIKI-19731</p> <p>### For more information If you have any questions or comments about this advisory: * Open an issue in [Jira](http://jira.xwiki.org) * Email us at [Security ML](mailto:security@xwiki.org)</p> <p><strong>Affected:</strong> Maven: org.xwiki.platform:xwiki-platform-icon-ui</p> <p>### Impact</p> <p>One can execute any wiki content with the right of IconThemeSheet author by creating an icon theme with the following content:</p> <p>``` }}} {{async async=&#34;true&#34;}} {{groovy}} println(&#34;Hello from Groovy!&#34;) {{/groovy}} {{/async}} {{{ ```</p> <p>Can be done by creating a new page or even through the user profile for users not having edit right.</p> <p>### Patches</p> <p>This has been patched in XWiki 14.9, 14.4.6, and 13.10.10.</p> <p>### Workarounds</p> <p>An easy workaround is to actually fix the bug in the page `IconThemesCode.IconThemeSheet` by applying the following modification: https://github.com/xwiki/xwiki-platform/commit/48caf7491595238af2b531026a614221d5d61f38#diff-2ec9d716673ee049937219cdb0a92e520f81da14ea84d144504b97ab2bdae243R45</p> <p>### References</p> <p>https://jira.xwiki.org/browse/XWIKI-19731</p> <p>### For more information If you have any questions or comments about this advisory: * Open an issue in [Jira](http://jira.xwiki.org) * Email us at [Security ML](mailto:security@xwiki.org)</p> https://cve.radiocsirt.org/vuln/ghsa-vwr6-qp4q-2wj7 https://cve.radiocsirt.org/vuln/gsd-2023-26472 gsd-2023-26472 https://cve.radiocsirt.org/vuln/gsd-2023-26472