CVE-2026-24128: XWiki Reflected Cross-Site Scripting Vulnerability in Web Templates
Summary
CVE-2026-24128: XWiki Affected by Reflected Cross-Site Scripting (XSS) in Error Messages. Affects org.xwiki.platform:xwiki-platform-web-templates across 3 version ranges.
>= 7.0-milestone-2, < 16.10.12
>= 17.0.0-rc-1, < 17.4.5
>= 17.5.0-rc-1, < 17.8.0-rc-1
Fixed in 16.10.12, 17.4.5 or 17.8.0-rc-1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
XWiki is an open-source platform designed for collaborative documentation and knowledge management. It allows users to create, edit, and manage content in a wiki-style format. The platform is built on Java and utilizes various components, including web templates, to render user interfaces. However, a reflected cross-site scripting (XSS) vulnerability has been identified in the web templates, which can be exploited if users are tricked into clicking malicious links.
Vulnerability Detail
The vulnerability arises from improper handling of user input in error messages within XWiki's web templates. An attacker can craft a URL that, when visited by a victim, executes arbitrary JavaScript code in the context of the victim's session. This can lead to unauthorized actions being performed on behalf of the victim, especially if they possess administrative or programming rights, potentially compromising the entire XWiki installation.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 7.0-milestone-2, < 16.10.1216.10.12 -
>= 17.0.0-rc-1, < 17.4.517.4.5 -
>= 17.5.0-rc-1, < 17.8.0-rc-117.8.0-rc-1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If immediate patching is not possible, a manual workaround can be applied by changing a single line in the 'templates/logging_macros.vm' file. The specific line to change can be found in the patch commit: https://github.com/xwiki/xwiki-platform/commit/8337ac8c3b19c37f306723b638b2cae8b0a57dbf#diff-8f16efedd19baae025db602d8736a105bfd8f72676af2c935b8195a0c356ee71. No restart is required after making this change.
Conclusion
The XWiki reflected cross-site scripting vulnerability (CVE-2026-24128) poses a significant risk to users, particularly those with elevated privileges. It is crucial to apply the available patches or implement the recommended workaround to mitigate potential exploitation.
See every vulnerability recorded for org.xwiki.platform:xwiki-platform-web-templates →
FAQ
It is a reflected cross-site scripting (XSS) vulnerability that allows attackers to execute arbitrary actions in XWiki.
Any user of XWiki who can be tricked into clicking a malicious link is at risk, especially those with administrative rights.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of this vulnerability is 6.5, indicating a moderate severity level.
You can apply the manual workaround by modifying the 'templates/logging_macros.vm' file as described in the workaround section.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.xwiki.platform:xwiki-platform-web-templates.
