Maven/org.xwiki.platform:xwiki-platform-livedata-livetable CVE-2026-53966: high 7.1, EPSS 0.77%
XWiki Platform Live Data Live Table Connector has privilege escalation from edit to script right through Live Data editing
Action: Upgrade org.xwiki.platform:xwiki-platform-livedata-livetable to 16.10.17 (16.10.x), 17.4.10 (17.4.x), 17.10.4 (17.10.x) or 18.1.0-rc-1 (18.1.x) or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 13.4-rc-1 | 16.10.17 | - |
| 17.0.0-rc-1 | 17.4.10 | - |
| 17.5.0-rc-1 | 17.10.4 | - |
| 18.0.0-rc-1 | 18.1.0-rc-1 | - |
Fixed versions
| 16.10.17 | 17.4.10 | 17.10.4 | 18.1.0-rc-1 |
Sources
- osv: GHSA-45ph-gxxr-gwgw
- nvd: CVE-2026-53966
- https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-45ph-gxxr-gwgw
- https://github.com/xwiki/xwiki-platform/commit/448b0f074cc6711410eb2647c4740454c92d1626
- https://github.com/xwiki/xwiki-platform
- https://jira.xwiki.org/browse/XWIKI-23986
CVE-2026-53966 · published · modified · JSON