Eval Injection in XWiki platform - CVE-2023-36470
Published: June 29, 2023 / Updated: May 5, 2026
Vulnerability identifier: #VU129940
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2023-36470
CWE-ID: CWE-95
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to execute arbitrary code.
The vulnerability exists due to improper neutralization of directives in dynamically evaluated code in icon themes when rendering icon sets from created or edited documents. A remote user can inject XWiki syntax and Velocity code to execute arbitrary code.
The injected code can be executed with programming rights, impacting the confidentiality, integrity, and availability of the whole XWiki instance.
Affected software
XWiki platform
How to mitigate CVE-2023-36470
Install security update from vendor's website.
XWiki platform - addressed in versions 14.10.6, 15.2