Vulnerability record · CVE-2023-29516 · published 19 April 2023

CVE-2023-29516: XWiki Platform AttachmentSelector code injection via unescaped button

Xwiki · Xwiki

XWiki Platform fails to properly escape the "Cancel and return to page" button on the default-installed XWiki.AttachmentSelector page, allowing injection of Groovy, Python or Velocity code. Any user with view rights on that page can trigger server-side code execution, giving full access to the XWiki installation.

8.8 CVSS 3.1 High EPSS 66% · top 0.8% CWE-74 · Injection

8.8CVSS 3.1 base score

66%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

6References, 4 tagged exploit

17 Jun 2026Last modified by NVD

Description

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with view rights on `XWiki.AttachmentSelector` can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation. The root cause is improper escaping in the "Cancel and return to page" button. This page is installed by default. This vulnerability has been patched in XWiki 15.0-rc-1, 14.10.1, 14.4.8, and 13.10.11. There are no known workarounds for this vulnerability.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

high priorityCVSS 8.8 with low privileges and no user interaction, plus very high EPSS and public exploit references, make this a high-priority patch target.

What it is

Impact

An attacker gains arbitrary server-side code execution in the XWiki context, leading to full compromise of the installation including data, configuration and potentially the host.

Attack surface

Reached over the network through the XWiki.AttachmentSelector page; the CVSS vector indicates low privileges are required (PR:L) and no user interaction (UI:N), so any authenticated user with view rights on that page can exploit it.

Exploitation

Not listed in CISA KEV, but EPSS is 0.65869 (99.2nd percentile) and vendor references are tagged Exploit, indicating public exploit material exists.

What to do

Upgrade to XWiki 15.0-rc-1, 14.10.1, 14.4.8 or 13.10.11, which contain the patch.
If immediate upgrade is not possible, restrict view rights on XWiki.AttachmentSelector to trusted users only.
Review and remove any unexpected modifications to the XWiki.AttachmentSelector page.
Monitor XWiki logs for Groovy, Python or Velocity execution errors originating from wiki pages.

Detection

Audit access logs for requests to XWiki.AttachmentSelector from non-administrative accounts.
Inspect the XWiki.AttachmentSelector page content for injected script blocks or unexpected code.
Alert on server-side errors or stack traces referencing Groovy, Python or Velocity evaluation from wiki pages.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Xwiki Xwiki

References

Link	Tags
https://github.com/xwiki/xwiki-platform/commit/aca1d677c58563bbe6e35c9e1c29fd8b12ebb996	Patch
https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-3989-4c6x-725f	ExploitPatchVendor Advisory
https://jira.xwiki.org/browse/XWIKI-20275	ExploitIssue TrackingPatchVendor Advisory
https://github.com/xwiki/xwiki-platform/commit/aca1d677c58563bbe6e35c9e1c29fd8b12ebb996	Patch
https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-3989-4c6x-725f	ExploitPatchVendor Advisory
https://jira.xwiki.org/browse/XWIKI-20275	ExploitIssue TrackingPatchVendor Advisory

Track CVE-2023-29516 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2025-24893XWiki SolrSearch unauthenticated remote code executionXWiki Platform's SolrSearch endpoint evaluates user-supplied search text as Groovy code, allowing arbitrary remote code execution. The flaw is reacha…KEVEPSS 100%analysed20 Feb 2025 9.9CVE-2023-27479Xwiki injection vulnerabilityXWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions any user with view righ…EPSS 1.1%7 Mar 2023 9.8CVE-2024-31996Xwiki code injection vulnerabilityXWiki Platform is a generic wiki platform. Starting in version 3.0.1 and prior to versions 4.10.19, 15.5.4, and 15.10-rc-1, the HTML escaping of esca…EPSS 2.1%10 Apr 2024 9.8CVE-2024-31982Xwiki code injection vulnerabilityXWiki Platform is a generic wiki platform. Starting in version 2.4-milestone-1 and prior to versions 4.10.20, 15.5.4, and 15.10-rc-1, XWiki's databas…EPSS 35%10 Apr 2024 9.8CVE-2024-21650XWiki user registration RCE via name fieldsXWiki Platform is vulnerable to remote code execution through its guest user registration feature. An attacker can inject malicious payloads into the…EPSS 93%analysed8 Jan 2024 9.8CVE-2023-46731XWiki Platform unescaped URL parameter allows remote code executionXWiki Platform fails to properly escape the section URL parameter used when displaying administration sections, allowing injection of code such as Gr…EPSS 89%analysed6 Nov 2023 9.8CVE-2023-26477XWiki Platform unauthenticated code injection via newThemeName parameterXWiki Platform versions from 6.3-rc-1 and 6.2.4 onward allow injection of arbitrary wiki syntax, including Groovy, Python and Velocity script macros,…EPSS 75%analysed2 Mar 2023 9.8CVE-2022-29161Xwiki broken cryptographic algorithm vulnerabilityXWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. The XWiki Crypto API will generate X509 cert…EPSS 0.41%6 May 2022

Source: NIST National Vulnerability Database (record CVE-2023-29516), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.