CVE-2026-40105: Reflected XSS Vulnerability in org.xwiki.platform:xwiki-platform-web-templates
Summary
CVE-2026-40105: XWiki has Reflected Cross-Site Scripting (XSS) in page history compare. Affects org.xwiki.platform:xwiki-platform-web-templates across 3 version ranges.
>= 10.4-rc-1, < 16.10.16
>= 17.0.0-rc-1, < 17.4.8
>= 17.5.0-rc-1, < 17.10.1
Fixed in 16.10.16, 17.4.8 or 17.10.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The org.xwiki.platform:xwiki-platform-web-templates package is a core component of the XWiki platform, which is an open-source enterprise wiki and application platform. It provides templates for web pages and is crucial for rendering content in XWiki. This package is widely used in various deployments of XWiki, making it essential for users to maintain its security and integrity.
Vulnerability Detail
A reflected cross-site scripting (XSS) vulnerability exists in the compare view between revisions of a page in the XWiki platform. This vulnerability allows attackers to execute arbitrary JavaScript code in the context of the user's browser. If an admin user is affected, it can lead to severe consequences, including compromising the confidentiality, integrity, and availability of the entire XWiki instance. The vulnerability arises from improper handling of URL parameters, which can be exploited by crafting malicious links.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 10.4-rc-1, < 16.10.1616.10.16 -
>= 17.0.0-rc-1, < 17.4.817.4.8 -
>= 17.5.0-rc-1, < 17.10.117.10.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If immediate updating is not possible, you can manually apply the patch by modifying the 'templates/changesdoc.vm' file in the deployed WAR. Ensure that URL parameters are properly escaped to mitigate the risk of XSS.
Conclusion
The CVE-2026-40105 vulnerability in the org.xwiki.platform:xwiki-platform-web-templates package poses a significant risk due to its potential for reflected XSS attacks. Users are strongly advised to update to the patched versions or apply the recommended workaround to safeguard their XWiki instances.
See every vulnerability recorded for org.xwiki.platform:xwiki-platform-web-templates →
FAQ
Reflected XSS occurs when an attacker injects malicious scripts into a web application, which then reflects the script back to the user's browser, allowing the attacker to execute code in the user's session.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to analyze your pom.xml without any signup.
If exploited, this vulnerability can lead to unauthorized access to sensitive information, session hijacking, and potentially full control over the XWiki instance, especially if an admin account is compromised.
Implementing proper input validation and output encoding practices can significantly reduce the risk of XSS vulnerabilities. Regularly updating dependencies and using security tools like Vulert can also help.
If you cannot update the package right away, apply the provided workaround by modifying the 'templates/changesdoc.vm' file to ensure URL parameters are properly escaped.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.xwiki.platform:xwiki-platform-web-templates.
