GitHub Advisoryadvisory · Maven

GHSA-w4fj-87j5-f25c XWiki has Reflected Cross-Site Scripting (XSS) in page history compare

MEDIUM Published 2026-04-14 Modified 2026-04-27 Official page ↗
Aliases
CVE-2026-40105
Ecosystem
Maven
Packages
org.xwiki.platform:xwiki-platform-web-templates
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-80
Reviewed
2026-04-14

Affected packages

• Maven org.xwiki.platform:xwiki-platform-web-templates: >= 10.4-rc-1, < 16.10.16 → fixed in 16.10.16 • Maven org.xwiki.platform:xwiki-platform-web-templates: >= 17.0.0-rc-1, < 17.4.8 → fixed in 17.4.8 • Maven org.xwiki.platform:xwiki-platform-web-templates: >= 17.5.0-rc-1, < 17.10.1 → fixed in 17.10.1

Description

Impact A reflected cross-site scripting vulnerability (XSS) in the compare view between revisions of a page allows executing JavaScript code in the user's browser. If the current user is an admin, this can not only affect the current user but also the confidentiality, integrity and availability of the whole XWiki instance. Patches The problem has been patched by properly escaping the URL parameters. Workarounds The patch can be applied manually to `templates/changesdoc.vm` in the deployed WAR. Attribution XWiki thanks Mike Cole @mikecole-mg for discovering and reporting this vulnerability.

Related

Alias · CVE (1)

  • CVE-2026-40105 XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. vulnerability

Weakness · CWE (1)

  • CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page weakness

References