JAVASCRIPT · AUGUST 2026 · EARLY WARNING

XWiki Platform Live Data Table Connector Privilege Escalation Warning

EARLY WARNING · UNCONFIRMED. This page describes a developing threat that 0Day surfaced from early signals and has not yet independently confirmed. Details may change. Always verify against the primary sources before acting.

Severity: HIGH
Affected component: xwiki (other)
Patched version: 18.1.0

GHSA-45PH-GXXR-GWGW

An early warning has been issued regarding a privilege escalation vulnerability in the XWiki Platform Live Data Table Connector. Users with edit rights may be able to escalate their privileges to script rights.

What happened

The XWiki Platform Live Data Table Connector reportedly allows users with edit rights to escalate their privileges to script rights through Live Data editing. This enables the execution of dangerous scripts and the sending of unfiltered HTML and JavaScript. The vulnerability has been patched in XWiki versions 16.10.17, 17.4.10, 17.10.4, and 18.1.0. Users of affected versions should upgrade to mitigate the risk.

The vulnerability, tracked as GHSA-45PH-GXXR-GWGW, was first flagged on 2026-08-19T19:18:04+00:00. It has not been reported as exploited in the wild. The affected components include xwiki versions less than 16.10.17, 17.4.10, 17.10.4, or 18.1.0.

What to do about it

Upgrade to XWiki version 18.1.0 or later to mitigate the privilege escalation vulnerability.
Review your XWiki deployment to ensure that only trusted users have edit rights.
Monitor the XWiki security advisories and GitHub repository for further updates and patches.
Consider implementing additional security measures to restrict script execution in your XWiki environment.

How 0Day would have caught this

MATCHED TO YOUR ACTUAL DEPENDENCY GRAPH0Day matches every incoming threat signal against your GitHub organization’s full dependency graph, including transitive dependencies. If xwiki is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.

Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.

Frequently asked questions

Am I affected?

You are affected if you are using XWiki versions less than 16.10.17, 17.4.10, 17.10.4, or 18.1.0.

What should I do right now?

Upgrade to XWiki version 18.1.0 or later to mitigate the vulnerability.

Has this been exploited in the wild?

There are no reports of this vulnerability being exploited in the wild at this time.

Where can I find more information?

Consult the primary sources provided, including the GitHub security advisory GHSA-45PH-GXXR-GWGW.

Sources

[GHSA-45ph-gxxr-gwgw] XWiki Platform Live Data Live Table Connector has privilege escalation from edit to script right through Live Data editing

Join the 0Day waitlist →

← Back to all threats