CVE-2025-24854: Apache JSPWiki Image Plugin XSS Vulnerability
Summary
CVE-2025-24854: Apache JSPWiki Cross-Site Scripting (XSS) Vulnerability in the Image Plugin. Affects org.apache.jspwiki:jspwiki-main versions < 2.12.3. Fixed in 2.12.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache JSPWiki is a popular open-source wiki engine that allows users to create and manage content collaboratively. It is built on Java and provides a range of features, including support for various plugins to extend its functionality. The Image plugin is one such extension that enables users to embed images within their wiki pages. However, this plugin has a vulnerability that can be exploited to execute malicious scripts.
Vulnerability Detail
The vulnerability arises from a Cross-Site Scripting (XSS) flaw in the Image plugin of Apache JSPWiki. An attacker can craft a specially designed request that, when processed by the server, allows the execution of arbitrary JavaScript in the browser of a victim who views the affected page. This can lead to unauthorized access to sensitive information, session hijacking, or other malicious activities. The vulnerability is classified under CWE-79, which pertains to improper neutralization of input during web page generation.
How To Fix
Minimum fixed version
2.12.3
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately feasible, a temporary workaround is to disable the Image plugin until a patch can be applied. This can be done by commenting out or removing the plugin configuration from the JSPWiki configuration files.
Conclusion
The Apache JSPWiki Image plugin has a significant XSS vulnerability that can be exploited by attackers to execute malicious scripts in users' browsers. It is crucial for users to upgrade to version 2.12.3 or later to protect against this vulnerability. Additionally, temporary workarounds are available for those unable to upgrade immediately.
See every vulnerability recorded for org.apache.jspwiki:jspwiki-main →
FAQ
CVE-2025-24854 is a vulnerability identifier for a Cross-Site Scripting (XSS) issue found in the Image plugin of Apache JSPWiki.
If exploited, this vulnerability can allow attackers to execute malicious scripts in the browsers of users viewing the affected wiki pages, potentially leading to data theft or session hijacking.
Versions prior to 2.12.3 are affected by this vulnerability. Users should upgrade to 2.12.3 or later to mitigate the risk.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check if your application is affected by this vulnerability using the Vulert playground at Vulert Scanner without any signup.
Vulert is a tool that helps developers monitor open-source vulnerabilities in their applications by analyzing the pom.xml file, providing real-time alerts and insights.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.jspwiki:jspwiki-main.
