XWiki Platform vulnerable to privilege escalation via async macro and IconThemeSheet from the user profile
Impact
One can execute any wiki content with the right of IconThemeSheet author by creating an icon theme with the following content:
}}}
{{async async="true"}}
{{groovy}}
println("Hello from Groovy!")
{{/groovy}}
{{/async}}
{{{Can be done by creating a new page or even through the user profile for users not having edit right.
Patches
This has been patched in XWiki 14.9, 14.4.6, and 13.10.10.
Workarounds
An easy workaround is to actually fix the bug in the page IconThemesCode.IconThemeSheet by applying the following modification: https://github.com/xwiki/xwiki-platform/commit/48caf7491595238af2b531026a614221d5d61f38#diff-2ec9d716673ee049937219cdb0a92e520f81da14ea84d144504b97ab2bdae243R45
References
https://jira.xwiki.org/browse/XWIKI-19731
For more information
If you have any questions or comments about this advisory:
- Open an issue in Jira
- Email us at Security ML
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Java / Kotlin (Maven) | org.xwiki.platform:xwiki-platform-icon-ui | >= 6.2-milestone-1, < 13.10.10, >= 14.0, < 14.4.6, >= 14.5, < 14.9 | 13.10.10, 14.4.6, 14.9 |
References
- https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-vwr6-qp4q-2wj7
- https://nvd.nist.gov/vuln/detail/CVE-2023-26472
- https://github.com/xwiki/xwiki-platform/commit/48caf7491595238af2b531026a614221d5d61f38#diff-2ec9d716673ee049937219cdb0a92e520f81da14ea84d144504b97ab2bdae243R45
- https://github.com/xwiki/xwiki-platform
- https://jira.xwiki.org/browse/XWIKI-19731
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H- Weakness (CWE)
CWE-116- Platform
- Java / Kotlin (Maven)
- Package
org.xwiki.platform:xwiki-platform-icon-ui- Disclosed
- 03.03.2023
- Updated
- 11.10.2026 13:19
Sources and licenses
OSV / GitHub Advisory Database - GHSA-vwr6-qp4q-2wj7 - CC BY 4.0
Vulnerability history: org.xwiki.platform:xwiki-platform-icon-ui
All published vulnerabilities of this package (Java / Kotlin (Maven)), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 3
- First → latest
- 11.2022 06.2023
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- Critical 3
Disclosures per year
- 2022: 1
- 2023: 2
- 2024: 0
- 2025: 0
- 2026: 0
-
XWiki Platform vulnerable to privilege escalation via async macro and IconThemeSheet from the user profile this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.