CVE-2023-37462: XWiki Platform improper escaping in XWikiSkinsSheet enables script injection and RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityCVSS 8.8 with high confidentiality, integrity and availability impact plus a very high EPSS score and public exploit references make this a serious risk, though it requires low privileges and is not in KEV.

What it is

XWiki Platform fails to properly escape content in the document SkinsCode.XWikiSkinsSheet, creating an injection vector that escalates view rights on that document to programming rights. This allows execution of arbitrary script macros, including Groovy and Python, resulting in remote code execution with unrestricted read and write access to all wiki contents. The flaw is triggered by opening a non-existing page whose name is crafted to contain a dangerous payload.

Impact

An attacker gains programming rights and can execute arbitrary Groovy or Python macros, leading to remote code execution and full read/write access to all wiki content. This effectively compromises the confidentiality, integrity and availability of the entire wiki instance.

Attack surface

The vector is network-reachable (AV:N) with low attack complexity and no user interaction, but requires low privileges (PR:L), meaning an authenticated user with basic view access can trigger it. The attack is delivered by requesting a non-existing page with a specially crafted name.

Exploitation

The record is not listed in CISA KEV, but EPSS is very high at 0.91592 (99.8th percentile), and multiple references are tagged Exploit, indicating public exploit information exists. No ransomware group usage is documented.

What to do

• Upgrade to XWiki 14.4.8, 14.10.4 or 15.0-rc-1 or later, which contain the fix.
• If upgrading is not possible, manually apply fix commit d9c88ddc to the impacted document SkinsCode.XWikiSkinsSheet.
• Restrict the ability of untrusted users to create or view pages, and review who holds programming rights.
• Monitor for and remove any unexpected pages with crafted names that could carry injection payloads.
• Use the vendor GHSA instructions to check whether an existing installation is vulnerable.

Detection

• Search wiki logs and page creation records for non-existing page requests with unusual or macro-like characters in the page name.
• Monitor for unexpected execution of Groovy or Python macros and for changes to wiki content made by low-privileged accounts.
• Alert on access to SkinsCode.XWikiSkinsSheet by users who do not normally interact with skin documents.
• Review audit logs for privilege escalation to programming rights or unexpected document edits.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.