CVE-2023-35150: XWiki Platform code injection lets any viewer execute code with programming rights

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityRemote code execution reachable by any user with view rights, with a patch available and very high EPSS, though not in KEV.

What it is

XWiki Platform fails to properly restrict code execution, so any user with view rights on a document can execute code with programming rights by crafting a URL containing a dangerous payload. This turns a low-privileged wiki account into remote code execution on the server. Patches exist in XWiki 15.0, 14.10.4 and 14.4.8.

Impact

An attacker gains remote code execution with the privileges of the XWiki server process, allowing full compromise of the wiki host and any data or credentials it can reach.

Attack surface

Reachable over the network via a crafted URL; the attacker needs an account with view rights on at least one document, and the CVSS vector indicates user interaction is required. No elevated privileges are needed beyond basic view access.

Exploitation

Not listed in CISA KEV, but EPSS is very high (0.776, 99.5th percentile) and a vendor JIRA reference is tagged Exploit, indicating public exploit detail is available. No ransomware usage is documented.

What to do

• Upgrade to XWiki 15.0, 14.10.4 or 14.4.8 (or later) immediately.
• If patching is delayed, restrict view rights and anonymous access so untrusted users cannot reach documents.
• Review and remove unnecessary programming rights from documents and authors.
• Monitor XWiki logs and web traffic for crafted URLs containing code payloads.
• Apply network controls to limit outbound and lateral movement from the XWiki host.

Detection

• Search web/proxy logs for XWiki requests with encoded or script-like payloads in URL parameters.
• Alert on XWiki processes spawning unexpected child processes or shells.
• Audit XWiki documents and revisions for newly added code using programming rights.
• Monitor for unusual outbound connections from the XWiki server.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.