CVE-2023-46731: XWiki Platform unescaped URL parameter allows remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityCVSS 9.8 with no authentication or interaction required and near-maximum EPSS makes this a top-priority remote code execution flaw.

What it is

XWiki Platform fails to properly escape the section URL parameter used when displaying administration sections, allowing injection of code such as Groovy. Any user with read access to the XWiki.AdminSheet document, which by default includes unauthenticated guests, can trigger it. The flaw affects confidentiality, integrity and availability of the whole XWiki instance.

Impact

An attacker can execute arbitrary code, including Groovy, on the XWiki server, gaining full control over the instance's data and availability.

Attack surface

Reached over the network through the section URL parameter of the administration section display code; no authentication or user interaction is required because the default read right on XWiki.AdminSheet is granted to everyone including guests.

Exploitation

The vendor advisory is tagged Exploit and EPSS is very high at 0.885 (99.8th percentile), but the CVE is not listed in CISA KEV and no ransomware use is documented.

What to do

• Upgrade to XWiki 14.10.14, 15.6 RC1 or 15.5.1, which contain the patch.
• If upgrade is not possible, apply the fix from commit fec8e0e53f9 manually.
• Remove view right for guests on the XWiki.AdminSheet document to block unauthenticated attacks.
• Restrict read access to XWiki.AdminSheet to space and wiki admins only.
• Review logs and configuration for signs of prior exploitation before patching.

Detection

• Search web server and XWiki logs for requests to administration section URLs containing unusual or encoded section parameter values.
• Monitor for Groovy or script-like content in section URL parameters reaching the XWiki application.
• Alert on access to XWiki.AdminSheet by unauthenticated or guest sessions.
• Look for unexpected outbound connections or process activity originating from the XWiki server after such requests.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.