CVE-2025-24853: Apache JSPWiki Cross-Site Scripting (XSS) Vulnerability via Header Link Rendering
Summary
CVE-2025-24853: Apache JSPWiki Cross-Site Scripting (XSS) Vulnerability via Header Link Rendering. Affects org.apache.jspwiki:jspwiki-main versions < 2.12.3. Fixed in 2.12.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache JSPWiki is a popular open-source wiki engine that allows users to create and manage wiki content using a simple markup syntax. It is designed for ease of use and flexibility, enabling collaborative content creation. However, it has been found to be vulnerable to a Cross-Site Scripting (XSS) attack, particularly when rendering header links using the wiki markup syntax.
Vulnerability Detail
The vulnerability arises from the improper handling of user input when creating header links. An attacker can craft a malicious request that executes JavaScript in the victim's browser, potentially leading to the theft of sensitive information. This issue is compounded by the markdown parser's ability to process similar attacks, making it critical for users to address this vulnerability promptly.
How To Fix
Minimum fixed version
2.12.3
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can sanitize user inputs to prevent the execution of malicious scripts. This can involve implementing input validation and escaping special characters in user-generated content.
Conclusion
The Apache JSPWiki vulnerability identified as CVE-2025-24853 poses a significant risk due to its potential for Cross-Site Scripting attacks. Users are strongly advised to upgrade to version 2.12.3 or later to mitigate this risk. Implementing input validation can serve as a temporary measure until the upgrade is completed.
See every vulnerability recorded for org.apache.jspwiki:jspwiki-main →
FAQ
The vulnerability is a Cross-Site Scripting (XSS) issue that allows attackers to execute JavaScript in the victim's browser through crafted header links.
Any user of Apache JSPWiki versions prior to 2.12.3 is at risk of this vulnerability.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring any signup.
If an immediate upgrade is not possible, implement input validation and sanitization as a temporary workaround to mitigate the risk.
If exploited, this vulnerability can lead to unauthorized access to sensitive information, session hijacking, and other malicious activities affecting users.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.jspwiki:jspwiki-main.
