CVE-2023-50732: XWiki

Medium severity, CVSS 6.3. EPSS: 0.5% chance of exploitation in the next 30 days.

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It's possible to execute a Velocity script without script right through the document tree. This has been patched in XWiki 14.10.7 and 15.2RC1.

Affected products

• XWiki XWiki: from 8.3, before 14.10.7 (fixed in 14.10.7); from 15.0, before 15.2 (fixed in 15.2)

Published 2023-12-21. Last modified 2026-06-17.