How severe is CVE-2023-26055?

CVE-2023-26055 has a CVSS 3.x base score of 9.9, rated critical severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.

Is CVE-2023-26055 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (63rd percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2023-26055?

CVE-2023-26055 primarily affects Xwiki Commons. In total, 5 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2023-26055?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.

When was CVE-2023-26055 published?

CVE-2023-26055 was published on 2023-03-02 and last updated on 2026-06-17.

CVE-2023-26055

CVE-2023-26055 is a critical-severity vulnerability in Xwiki Commons with a CVSS 3.x base score of 9.9. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-150.

Key facts

Severity: Critical (CVSS 3.x base score 9.9)
EPSS exploit prediction: 1% (63rd percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-150
Affected product: Xwiki Commons
Published: 2023-03-02
Last modified: 2026-06-17

Description

XWiki Commons are technical libraries common to several other top level XWiki projects. Starting in version 3.1-milestone-1, any user can edit their own profile and inject code, which is going to be executed with programming right. The same vulnerability can also be exploited in all other places where short text properties are displayed, e.g., in apps created using Apps Within Minutes that use a short text field. The problem has been patched on versions 13.10.9, 14.4.4, 14.7RC1.

Frequently asked questions

What is CVE-2023-26055?: XWiki Commons are technical libraries common to several other top level XWiki projects. Starting in version 3.1-milestone-1, any user can edit their own profile and inject code, which is going to be executed with programming right. The same vulnerability can also be exploited in all other places where short text properties are displayed, e.g., in apps created using Apps Within Minutes that use a short text field. The problem has been patched on versions 13.10.9, 14.4.4, 14.7RC1.
How severe is CVE-2023-26055?: CVE-2023-26055 has a CVSS 3.x base score of 9.9, rated critical severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2023-26055 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (63rd percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2023-26055?: CVE-2023-26055 primarily affects Xwiki Commons. In total, 5 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2023-26055?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
When was CVE-2023-26055 published?: CVE-2023-26055 was published on 2023-03-02 and last updated on 2026-06-17.

References

Affected products (5)

cpe:2.3:a:xwiki:commons:*:*:*:*:*:*:*:*
cpe:2.3:a:xwiki:commons:3.1:milestone1:*:*:*:*:*:*
cpe:2.3:a:xwiki:commons:3.1:milestone2:*:*:*:*:*:*
cpe:2.3:a:xwiki:commons:3.1.1:*:*:*:*:*:*:*
cpe:2.3:a:xwiki:commons:14.4:rc1:*:*:*:*:*:*

More vulnerabilities in Xwiki Commons

CVE-2023-36471 — Critical (CVSS 9.0): Xwiki commons is the common modules used by other XWiki top level projects. The HTML sanitizer that is included in…
CVE-2023-29528 — Critical (CVSS 9.0): XWiki Commons are technical libraries common to several other top level XWiki projects. The "restricted" mode of the…
CVE-2022-24898 — Medium (CVSS 4.9): org.xwiki.commons:xwiki-commons-xml is a common module used by other XWiki top level projects. Starting in version 2.7…

All CVEs affecting Xwiki Commons →

Other CWE-150 vulnerabilities

CVE-2022-30123 — Critical (CVSS 10.0): A sequence injection vulnerability exists in Rack <2.0.9.1, <2.1.4.1 and <2.2.3.1 which could allow is a possible shell…
CVE-2020-6932 — Critical (CVSS 10.0): An information disclosure and remote code execution vulnerability in the slinger web server of the BlackBerry QNX…
CVE-2025-47284 — Critical (CVSS 9.9): Gardener implements the automated management and operation of Kubernetes clusters as a service. A security…
CVE-2026-25996 — Critical (CVSS 9.8): Inspektor Gadget is a set of tools and framework for data collection and system inspection on Kubernetes clusters and…
CVE-2025-25286 — Critical (CVSS 9.8): Crayfish is a collection of Islandora 8 microservices, one of which, Homarus, provides FFmpeg as a microservice. Prior…
CVE-2023-3265 — Critical (CVSS 9.8): An authentication bypass exists on CyberPower PowerPanel Enterprise by failing to sanitize meta-characters from the…

Browse all CWE-150 vulnerabilities →