CVE-2023-36470 Code injection in icon themes of XWiki Platform

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. By either creating a new or editing an existing document with an icon set, an attacker can inject XWiki syntax and Velocity code that is executed with programming rights and thus allows remote...

CVE-2023-36470

CVE-2023-36470 affects XWiki Platform. When a document is created or edited using an icon set, an attacker can inject XWiki syntax and Velocity code that runs with programming rights, enabling remote code execution. Attack vectors include the icon set HTML/XWiki syntax definitions and the icon pi...