CVE-2023-26559: Sync Oxygen Content Fusion

Medium severity, CVSS 5.3. EPSS: 1% chance of exploitation in the next 30 days.

A directory traversal vulnerability in Oxygen XML Web Author before 25.0.0.3 build 2023021715 and Oxygen Content Fusion before 5.0.3 build 2023022015 allows an attacker to read files from a WEB-INF directory via a crafted HTTP request. (XML Web Author 24.1.0.3 build 2023021714 and 23.1.1.4 build 2023021715 are also fixed versions.)

Affected products

• Sync Oxygen Content Fusion: before 5.0.3 (fixed in 5.0.3)
• Sync Oxygen XML Web Author: before 23.1.1.4 (fixed in 23.1.1.4); from 24.0.0.0, before 24.1.0.3 (fixed in 24.1.0.3); from 25.0.0.0, before 25.1.0.3 (fixed in 25.1.0.3)

Published 2023-04-14. Last modified 2026-06-17.