{"id":"CVE-2026-24128","summary":"XWiki Affected by Reflected Cross-Site Scripting (XSS) in Error Messages","details":"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Versions 7.0-milestone-2 through 16.10.11, 17.0.0-rc-1 through 17.4.4, and 17.5.0-rc-1 through 17.7.0 contain a reflected Cross-site Scripting (XSS) vulnerability, which allows an attacker to craft a malicious URL and execute arbitrary actions with the same privileges as the victim. If the victim has administrative or programming rights, those rights can be exploited to gain full access to the XWiki installation. This issue has been patched in versions 17.8.0-rc-1, 17.4.5 and 16.10.12. To workaround, the patch can be applied manually, only a single line in templates/logging_macros.vm needs to be changed, no restart is required.","aliases":["GHSA-wvqx-m5px-6cmp"],"modified":"2026-08-12T15:31:44.154646Z","published":"2026-01-23T23:18:31.366Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24128.json","cna_assigner":"GitHub_M","cwe_ids":["CWE-79","CWE-80"]},"references":[{"type":"WEB","url":"https://github.com/xwiki/xwiki-platform/releases/tag/xwiki-platform-16.10.12"},{"type":"WEB","url":"https://github.com/xwiki/xwiki-platform/releases/tag/xwiki-platform-17.4.5"},{"type":"WEB","url":"https://github.com/xwiki/xwiki-platform/releases/tag/xwiki-platform-17.8.0-rc-1"},{"type":"WEB","url":"https://jira.xwiki.org/browse/XWIKI-23462"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24128.json"},{"type":"ADVISORY","url":"https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-wvqx-m5px-6cmp"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-24128"},{"type":"FIX","url":"https://github.com/xwiki/xwiki-platform/commit/8337ac8c3b19c37f306723b638b2cae8b0a57dbf"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/xwiki/xwiki-commons","events":[{"introduced":"bee2eb61c2fee64b0a09dc50a59b8c45f920ffa8"},{"fixed":"37c2f73dd9e1ae4fcc550d021970976b27d20b4d"},{"introduced":"0"},{"fixed":"585e0ca0b3d7b7894414477f238076a61f2338a2"},{"introduced":"ce86f8e14d06ac154f5b1bd5f76cd78b8cc562c3"},{"fixed":"2c3679dea4a9c81c5474901b926599f8a18a445b"},{"introduced":"1bae15224dbe5a091db7606bc7ecc5294d349c35"},{"last_affected":"1bae15224dbe5a091db7606bc7ecc5294d349c35"}],"database_specific":{"cpe":["cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*","cpe:2.3:a:xwiki:xwiki:7.0:milestone2:*:*:*:*:*:*"],"extracted_events":[{"introduced":"7.0.1"},{"fixed":"16.10.12"},{"introduced":"17.0.1"},{"fixed":"17.4.5"},{"introduced":"17.6.0"},{"fixed":"17.8.0"},{"introduced":"7.0-milestone2"},{"last_affected":"7.0-milestone2"}],"source":["CPE_RANGE","CPE_STRING"]}},{"type":"GIT","repo":"https://github.com/xwiki/xwiki-platform","events":[{"introduced":"881f610132785aab498f25b3b9eb2671e87ad5cd"},{"fixed":"d2aea778d4897c6c438e37df11148b7b8d8b2521"},{"introduced":"0"},{"fixed":"b4ed1b468a106f454f62a03c1ec40b27c7f221bb"},{"introduced":"5a6a9f909d2944df9fed8ead996ca250c28159ba"},{"fixed":"fad7aeced67584f9830735538cfddd870f3a83af"},{"introduced":"e52919258b5491ab1fef8ff388c85ad3d4c25caf"},{"fixed":"8337ac8c3b19c37f306723b638b2cae8b0a57dbf"},{"fixed":"157fad595ccf23b88616d80787f54fe0b7640e8e"}],"database_specific":{"cpe":["cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*","cpe:2.3:a:xwiki:xwiki:7.0:milestone2:*:*:*:*:*:*"],"extracted_events":[{"introduced":"7.0.1"},{"fixed":"16.10.12"},{"introduced":"17.0.1"},{"fixed":"17.4.5"},{"introduced":"17.6.0"},{"fixed":"17.8.0"},{"introduced":"7.0-milestone2"},{"last_affected":"7.0-milestone2"}],"source":["CPE_RANGE","CPE_STRING","REFERENCES"]}}],"versions":["7.0-milestone2","xwiki-commons-17.8.0-rc-1","xwiki-commons-16.10.11","xwiki-commons-17.4.4","xwiki-commons-17.4.3","xwiki-commons-16.10.10","xwiki-commons-17.4.2","xwiki-commons-16.10.9","xwiki-commons-17.4.1","xwiki-commons-17.4.0","xwiki-commons-17.4.0-rc-1","xwiki-commons-16.10.8","xwiki-commons-16.10.7","xwiki-commons-16.10.6","xwiki-commons-16.10.5","xwiki-commons-16.10.4","xwiki-commons-16.10.3","xwiki-commons-16.10.2","xwiki-commons-16.10.1","xwiki-commons-16.10.0","xwiki-commons-16.10.0-rc-1","xwiki-commons-8.3-milestone-2","xwiki-commons-8.3-milestone-1","xwiki-commons-8.2-milestone-2","xwiki-commons-8.2-milestone-1","xwiki-commons-8.1-milestone-2","xwiki-commons-8.1-milestone-1","xwiki-commons-8.0-milestone-2","xwiki-commons-8.0-milestone-1","xwiki-commons-7.0-milestone-2","xwiki-platform-17.8.0-rc-1","xwiki-platform-16.10.11","xwiki-platform-17.4.4","xwiki-platform-17.4.3","xwiki-platform-16.10.10","xwiki-platform-17.4.2","xwiki-platform-16.10.9","xwiki-platform-17.4.0","xwiki-platform-17.4.0-rc-1","xwiki-platform-16.10.8","xwiki-platform-16.10.7","xwiki-platform-16.10.6","xwiki-platform-16.10.5","xwiki-platform-16.10.4","xwiki-platform-16.10.3","xwiki-platform-16.10.2","xwiki-platform-16.10.1","xwiki-platform-16.10.0","xwiki-platform-16.10.0-rc-1","xwiki-platform-9.9-rc-2","xwiki-platform-8.3-milestone-1","xwiki-platform-8.2-milestone-2","xwiki-platform-8.2-milestone-1","xwiki-platform-8.1-milestone-2","xwiki-platform-8.1-milestone-1","xwiki-platform-8.0-milestone-2","xwiki-platform-8.0-milestone-1","xwiki-platform-7.4-milestone-2","xwiki-platform-7.4-milestone-1","xwiki-platform-7.3-milestone-2"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-24128.json","vanir_signatures_modified":"2026-08-12T15:31:44Z","vanir_signatures":[{"signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/8337ac8c3b19c37f306723b638b2cae8b0a57dbf","target":{"file":"xwiki-platform-core/xwiki-platform-web/xwiki-platform-web-templates/src/test/java/org/xwiki/web/DistributionPageTest.java"},"deprecated":false,"digest":{"line_hashes":["247533140513409864280582215810489605138","238067460823904613680606319078182315816","236788621686743516294722688572955957700","334139323190875973725709008790854511140","11667579377098436693813695706504377924","213132681225388072938157955348550091381","322293097449625621698657285671153349469","232762291632664481677922594443347745093","180917655604538611120923791753305419540","294167561123676085205456285140799258439","5340197204132336205193938135806129585","147669170676562565424965577810246502438","337657148049501418349849708670023081294","124772006295600472447957242944907099551"],"threshold":0.9},"id":"CVE-2026-24128-23b67196"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H"}]}