cve/2023/CVE-2023-27480.md

### [CVE-2023-27480](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-27480)
![](https://img.shields.io/static/v1?label=Product&message=xwiki-platform&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=%3D%20%3E%3D%201.1-milestone-3%2C%20%3C%2013.10.11%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-611%3A%20Improper%20Restriction%20of%20XML%20External%20Entity%20Reference&color=brighgreen)

### Description

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions any user with edit rights on a document can trigger an XAR import on a forged XAR file, leading to the ability to display the content of any file on the XWiki server host. This vulnerability has been patched in XWiki 13.10.11, 14.4.7 and 14.10-rc-1. Users are advised to upgrade. Users unable to upgrade may apply the patch `e3527b98fd` manually.

### POC

#### Reference
No PoCs from references.

#### Github
- https://github.com/karimhabush/cyberowl