CVE-2023-26477: XWiki Platform unauthenticated code injection via newThemeName parameter

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityCVSS 9.8 with no authentication or user interaction required, combined with a very high EPSS score and public exploit references, makes this an urgent remote code execution risk.

What it is

XWiki Platform versions from 6.3-rc-1 and 6.2.4 onward allow injection of arbitrary wiki syntax, including Groovy, Python and Velocity script macros, through the newThemeName request parameter combined with additional parameters. Because the injected macros execute server-side, this is a remote code execution flaw in a widely deployed wiki platform. It is patched in 13.10.10, 14.9-rc-1 and 14.4.6.

Impact

An attacker can execute arbitrary server-side code in the XWiki application context, leading to full compromise of confidentiality, integrity and availability. This can expose or modify wiki content, credentials and underlying host resources.

Attack surface

Reachable over the network through an HTTP request carrying the newThemeName parameter and related parameters; the CVSS vector shows no privileges or user interaction required. No authentication is needed per the AV:N/AC:L/PR:N/UI:N vector.

Exploitation

Not listed in CISA KEV, but EPSS is very high at 0.74757 (99.478th percentile) and the vendor advisory and Jira references are tagged Exploit, indicating public exploit information exists.

What to do

• Upgrade XWiki Platform to 13.10.10, 14.9-rc-1, 14.4.6 or a later supported release.
• If immediate upgrade is not possible, apply the documented workaround by editing FlamingoThemesCode.WebHomeSheet to match the patch changes.
• Restrict network access to the XWiki instance to trusted users or networks until patched.
• Review and remove any untrusted or unnecessary script macro execution rights for wiki users.
• Monitor XWiki logs for unexpected Groovy, Python or Velocity macro execution.

Detection

• Search HTTP access logs for requests containing the newThemeName parameter, especially with unusual or encoded values.
• Inspect XWiki application logs for Groovy, Python or Velocity macro execution errors or unexpected script invocations.
• Monitor for outbound network connections or process creation from the XWiki server that are not typical for the application.
• Audit wiki page and theme configuration changes for unauthorized modifications.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.