CVE-2026-26000 json
XWiki Platform affected by click-jacking through CSS injection in comments
published 2026-02-12 8 mo ago modified 2026-06-17 4 mo ago also EUVD-2026-6694 , GHSA-74rh-c5rh-88vg
- cvss
- 6.1
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 24%
- public exploits
- 0
- none known
Summary
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Prior to 17.9.0, 17.4.6, and 16.10.13, it's possible using comments to inject CSS that would transform the full wiki in a link area leading to a malicious page. This vulnerability is fixed in 17.9.0, 17.4.6, and 16.10.13.
Patch / fix
- maven org.xwiki.platform:xwiki-platform-web 16.10.13, 17.4.6, 17.9.0
- org.xwiki.platform xwiki-platform-web 16.10.13, 17.4.6, 17.9.0
- xwiki xwiki 16.10.13, 17.4.6, 17.9.0
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 8 mo ago
Exploit prediction
0.31% chance of exploitation in the next 30 days, higher than 24% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 5.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N |
| CNA | 4.0 | 5.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| NVD | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.xwiki.platform:xwiki-platform-web | >=17.5.0, <17.9.0 >=17.0.0-rc-1, <17.4.6 <16.10.13 |
17.9.0 17.4.6 16.10.13 |
Affected products
- xwiki xwiki-platform
Classification
- Weakness
-
- CWE-1021 Improper Restriction of Rendered UI Layers or Frames
References
-
github.com
/xwiki/xwiki-platform/security/advisories/GHSA-74rh-c5rh-88vg
web, patch, vendor-advisory
-
github.com
/xwiki/xwiki-platform/pull/4645
web
-
github.com
/xwiki/xwiki-platform/commit/29cb81f3a5387cf822d7e7534bdd63903275f86b
web
-
github.com
/xwiki/xwiki-platform/commit/7b5a4f8c34d9b1da3d966e17f7dbccabac448e75
web
-
github.com
/xwiki/xwiki-platform/releases/tag/xwiki-platform-17.4.6
web, product, release-notes
-
nvd.nist.gov
/vuln/detail/CVE-2026-26000
advisory
-
github.com
/xwiki/xwiki-platform
package
-
jira.xwiki.org
/browse/XWIKI-23433
web
-
xwiki.org
/xwiki/bin/view/ReleaseNotes/Data/XWiki/17.9.0RC1/Entry006
web
Sources
- CVE List CVE-2026-26000
- GitHub Advisory GHSA-74rh-c5rh-88vg
- NVD CVE-2026-26000
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.