CVE-2023-32071: XWiki Platform stored XSS via crafted attachment URL

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

high priorityCritical CVSS score of 9.0 and very high EPSS probability, but exploitation requires a low-privileged account and victim interaction, and no KEV listing or known ransomware use is documented.

What it is

XWiki Platform allows JavaScript execution with the privileges of any user who is lured to a specially crafted URL targeting a page containing an attachment. The flaw affects versions from 2.2-milestone-1 up to, but not including, 14.4.8, 14.10.4, and 15.0-rc-1, and is patched in those releases. Because the injected script runs in the victim's session, it can act as that user across the wiki.

Impact

An attacker can execute arbitrary JavaScript in a victim's browser session, enabling actions such as reading or modifying wiki content, stealing session data, or performing privileged operations as the victim. The CVSS vector indicates high confidentiality, integrity, and availability impact with scope change.

Attack surface

Reached over the network via a crafted URL pointing to a wiki page that contains an attachment; the attacker needs a low-privileged account to place or reference the content, and the victim must click the link (user interaction required). No unauthenticated path is described.

Exploitation

Not listed in CISA KEV and no ransomware usage is documented, but EPSS is very high (0.70386, 99.35th percentile), indicating elevated likelihood of exploitation. References include a vendor advisory and patch commit but no public exploit tag.

What to do

• Upgrade XWiki to 15.0-rc-1, 14.10.4, or 14.4.8 (or later) to apply the official fix.
• If immediate upgrade is not possible, apply the workaround by editing templates/importinline.vm as described in commit 28905f7f518cc6f21ea61fe37e9e1ed97ef36f01.
• Restrict who can create or upload attachments and pages to reduce the pool of low-privileged accounts that can stage the malicious URL.
• Warn users not to follow unsolicited wiki links and consider content security policy or output encoding controls to limit script execution.

Detection

• Monitor web logs for requests to wiki pages with attachment parameters containing script-like payloads or unusual encoding.
• Review wiki audit logs for attachment uploads or page edits by low-privileged users followed by access to crafted URLs.
• Search for anomalous JavaScript execution or session activity in browser-side telemetry tied to XWiki pages.
• Check for unauthorized changes to templates/importinline.vm or other template files that could indicate workaround tampering.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.