CVE-2023-50721: XWiki search admin UI extension fields allow script macro injection RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityRemote code execution with high impact and a very high EPSS score, though exploitation requires an authenticated editor account and no KEV listing or public exploit is recorded.

What it is

XWiki Platform fails to escape the id and label of search user interface extensions in the search administration interface, letting an attacker inject XWiki syntax that includes script macros such as Groovy macros. Because those macros execute server-side, the flaw exposes the confidentiality, integrity and availability of the entire XWiki instance. It affects versions from 4.5-rc-1 up to before 14.10.15, 15.5.2 and 15.7-rc-1.

Impact

An attacker gains remote code execution on the XWiki server, allowing full compromise of the instance's data and services. The CVSS vector rates high confidentiality, integrity and availability impact.

Attack surface

Reachable over the network through the wiki editing and search administration interfaces. Any authenticated user who can edit a page, including their own profile which is editable by default, can plant the malicious extension; no user interaction beyond that editing is required.

Exploitation

Not listed in CISA KEV and no ransomware use is documented, but EPSS is very high at 0.788 (99.6th percentile), indicating elevated likelihood of exploitation. All references are patch, vendor advisory or issue tracking links, with no public exploit reference supplied.

What to do

• Upgrade to XWiki 14.10.15, 15.5.2 or 15.7-rc-1 or later.
• If upgrading is not possible, manually apply the patch to the XWiki.SearchAdmin page as described in the advisory.
• Restrict who can edit wiki pages, especially user profiles, until the fix is in place.
• Review and remove any unexpected user interface extensions added to documents.
• Monitor XWiki logs for Groovy or other script macro execution from search administration.

Detection

• Search wiki documents for injected XWiki syntax or script macros in UI extension id and label fields.
• Alert on Groovy or other script macro execution events in XWiki logs, particularly tied to search administration.
• Audit recent edits to user profiles and other broadly editable pages for unexpected extension additions.
• Monitor for anomalous server-side process or command activity originating from the XWiki application.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.