CVE-2026-26000: XWiki Platform Web Vulnerable to Click-Jacking via CSS Injection in Comments
Summary
CVE-2026-26000: XWiki vulnerable to click-jacking through CSS injection in comments. Affects org.xwiki.platform:xwiki-platform-web across 3 version ranges.
< 16.10.13
>= 17.0.0-rc-1, < 17.4.6
>= 17.5.0, < 17.9.0
Fixed in 16.10.13, 17.4.6 or 17.9.0, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
XWiki is an open-source wiki platform that allows users to create and manage collaborative content. It is designed to be extensible and customizable, providing a rich set of features for content management, including support for comments. However, the platform has a vulnerability that allows CSS injection through comments, which can lead to click-jacking attacks.
Vulnerability Detail
The vulnerability arises from the ability to inject CSS into comments, which can manipulate the appearance of the wiki, effectively turning it into a deceptive link area that redirects users to malicious sites. This issue affects all versions of XWiki, making it a significant security concern. Attackers can exploit this vulnerability to trick users into clicking on links that lead to harmful web pages, potentially compromising user data and security.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 16.10.1316.10.13 -
>= 17.0.0-rc-1, < 17.4.617.4.6 -
>= 17.5.0, < 17.9.017.9.0
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
While there is no out-of-the-box workaround, users can implement a similar confirmation mechanism by reusing the JavaScript code provided for the security measure. Here is an example of how to include it in a JSX object within the wiki:
<script src="https://github.com/xwiki/xwiki-platform/blob/xwiki-platform-17.9.0/xwiki-platform-core/xwiki-platform-web/xwiki-platform-web-war/src/main/webapp/resources/uicomponents/link/link-protection.js"></script>
Conclusion
The XWiki platform is currently vulnerable to click-jacking attacks due to CSS injection through comments. Users are strongly advised to update to the latest patched versions to mitigate this risk. Implementing the provided workaround can offer temporary relief until an update can be performed.
See every vulnerability recorded for org.xwiki.platform:xwiki-platform-web →
FAQ
Click-jacking is a malicious technique where an attacker tricks a user into clicking on something different from what the user perceives, potentially leading to unauthorized actions.
If you are using any version of XWiki prior to 17.9.0, 17.4.6, or 16.10.13, your installation is vulnerable. You can also use Vulert to check for vulnerabilities in your application.
While waiting for an update, consider implementing the provided JavaScript workaround to add a confirmation step for links leading to untrusted domains.
You can refer to the JIRA ticket for this vulnerability at https://jira.xwiki.org/browse/XWIKI-23433 or the documentation at https://www.xwiki.org/xwiki/bin/view/ReleaseNotes/Data/XWiki/17.9.0RC1/Entry006/.
Vulert is a tool that monitors and alerts users about open-source vulnerabilities in their software using just the pom.xml file. You can check if your application is affected by this vulnerability using the Vulert playground at Vulert Scanner without any signup.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.xwiki.platform:xwiki-platform-web.
