← Vulnerability feed

Vulnerability record · CVE-2023-37912 · published 25 October 2023

CVE-2023-37912: Xwiki-rendering vulnerability

Xwiki · Xwiki Rendering

XWiki Rendering is a generic Rendering system that converts textual input in a given syntax into another syntax. Prior to version 14.10.6 of `org.xwiki.platform:xwiki-core-rendering-macro-footnotes` and `org.xwiki.platform:xwiki-rendering-macro-footnotes` and prior to version 15.1-rc-1 of `org.xwiki.platform:xwiki-rendering-macro-footnotes`, the footnote macro executed its content in a potentially different context than the one in which it was defined. In particular in combination with the include macro, this allows privilege escalation from a simple user account in XWiki to programming rights and thus remote code execution, impacting the confidentiality, integrity and availability of the whole XWiki installation. This vulnerability has been patched in XWiki 14.10.6 and 15.1-rc-1. There is no workaround apart from upgrading to a fixed version of the footnote macro.

8.8 CVSS 3.1 High EPSS 1.2% · top 31.9% CWE-270 · CWE-270
8.8CVSS 3.1 base score
1.2%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
6References, 2 tagged exploit
17 Jun 2026Last modified by NVD

Description

XWiki Rendering is a generic Rendering system that converts textual input in a given syntax into another syntax. Prior to version 14.10.6 of `org.xwiki.platform:xwiki-core-rendering-macro-footnotes` and `org.xwiki.platform:xwiki-rendering-macro-footnotes` and prior to version 15.1-rc-1 of `org.xwiki.platform:xwiki-rendering-macro-footnotes`, the footnote macro executed its content in a potentially different context than the one in which it was defined. In particular in combination with the include macro, this allows privilege escalation from a simple user account in XWiki to programming rights and thus remote code execution, impacting the confidentiality, integrity and availability of the whole XWiki installation. This vulnerability has been patched in XWiki 14.10.6 and 15.1-rc-1. There is no workaround apart from upgrading to a fixed version of the footnote macro.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/xwiki/xwiki-rendering/commit/5f558b8fac8b716d19999225f38cb8ed0814116e Patch
https://github.com/xwiki/xwiki-rendering/security/advisories/GHSA-35j5-m29r-xfq5 PatchVendor Advisory
https://jira.xwiki.org/browse/XRENDERING-688 ExploitIssue TrackingPatchVendor Advisory
https://github.com/xwiki/xwiki-rendering/commit/5f558b8fac8b716d19999225f38cb8ed0814116e Patch
https://github.com/xwiki/xwiki-rendering/security/advisories/GHSA-35j5-m29r-xfq5 PatchVendor Advisory
https://jira.xwiki.org/browse/XRENDERING-688 ExploitIssue TrackingPatchVendor Advisory

Track CVE-2023-37912 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.6CVE-2023-37908Xwiki-rendering cross-site scripting vulnerabilityXWiki Rendering is a generic Rendering system that converts textual input in a given syntax into another syntax. The cleaning of attributes during XH…EPSS 1.1%8.7CVE-2025-66474Xwiki-rendering code injection vulnerabilityXWiki Rendering is a generic rendering system that converts textual input in a given syntax (wiki syntax, HTML, etc) into another syntax (XHTML, etc)…EPSS 1.0%6.5CVE-2026-24128Xwiki cross-site scripting vulnerabilityXWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Versions 7.0-milestone-2 through 16.10.11, 1…EPSS 0.56%7.8CVE-2021-3493Ubuntu Linux kernel overlayfs file capability privilege escalationThe Linux kernel overlayfs implementation failed to properly validate file capability settings on files in an underlying filesystem with respect to u…KEVEPSS 49%analysed

Source: NIST National Vulnerability Database (record CVE-2023-37912), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.