GitHub Advisoryadvisory · Maven

GHSA-wvqx-m5px-6cmp XWiki Affected by Reflected Cross-Site Scripting (XSS) in Error Messages

MEDIUM Published 2026-01-23 Modified 2026-01-28 Official page ↗
Aliases
CVE-2026-24128
Ecosystem
Maven
Packages
org.xwiki.platform:xwiki-platform-web-templates
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H
Weaknesses
CWE-79, CWE-80
Reviewed
2026-01-23

Affected packages

• Maven org.xwiki.platform:xwiki-platform-web-templates: >= 7.0-milestone-2, < 16.10.12 → fixed in 16.10.12 • Maven org.xwiki.platform:xwiki-platform-web-templates: >= 17.0.0-rc-1, < 17.4.5 → fixed in 17.4.5 • Maven org.xwiki.platform:xwiki-platform-web-templates: >= 17.5.0-rc-1, < 17.8.0-rc-1 → fixed in 17.8.0-rc-1

Description

Impact A reflected cross site scripting (XSS) vulnerability in XWiki allows an attacker to execute arbitrary actions in XWiki with the rights of the victim if the attacker manages to trick a victim into visiting a crafted URL. If the victim has administrative or programming rights, those rights can be exploited to gain full access to the XWiki installation. Patches This vulnerability has been patched in XWiki 17.8.0RC1, 17.4.5 and 16.10.12. Workarounds The patch can be applied manually, only a single line in `templates/logging_macros.vm` needs to be changed, no restart is required. References • https://github.com/xwiki/xwiki-platform/commit/8337ac8c3b19c37f306723b638b2cae8b0a57dbf • https://jira.xwiki.org/browse/XWIKI-23462 Attribution We thank Mike Cole @mikecole-mg for discovering and reporting this vulnerability.

Related

Alias · CVE (1)

  • CVE-2026-24128 XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. vulnerability

Weakness · CWE (2)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness
  • CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page weakness

References