{"id":"CVE-2026-24128","aliases":["GHSA-wvqx-m5px-6cmp"],"url":"https://o3.security/vulnerability/CVE-2026-24128","summary":"XWiki Affected by Reflected Cross-Site Scripting (XSS) in Error Messages","details":"### Impact\nA reflected cross site scripting (XSS) vulnerability in XWiki allows an attacker to execute arbitrary actions in XWiki with the rights of the victim if the attacker manages to trick a victim into visiting a crafted URL. If the victim has administrative or programming rights, those rights can be exploited to gain full access to the XWiki installation.\n\n### Patches\nThis vulnerability has been patched in XWiki 17.8.0RC1, 17.4.5 and 16.10.12.\n\n### Workarounds\nThe [patch](https://github.com/xwiki/xwiki-platform/commit/8337ac8c3b19c37f306723b638b2cae8b0a57dbf#diff-8f16efedd19baae025db602d8736a105bfd8f72676af2c935b8195a0c356ee71) can be applied manually, only a single line in `templates/logging_macros.vm` needs to be changed, no restart is required.\n\n### References\n* https://github.com/xwiki/xwiki-platform/commit/8337ac8c3b19c37f306723b638b2cae8b0a57dbf\n* https://jira.xwiki.org/browse/XWIKI-23462\n\n### Attribution\n\nWe thank Mike Cole @mikecole-mg for discovering and reporting this vulnerability.","published":"2026-01-23T23:18:31.366Z","modified":"2026-10-28T11:10:03.068277896Z","cvss":null,"epss":{"score":0.00514,"percentile":0.4263,"asOf":"2026-09-17"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Maven","name":"org.xwiki.platform:xwiki-platform-web-templates","fixedVersion":"16.10.12"},{"ecosystem":"Maven","name":"org.xwiki.platform:xwiki-platform-web-templates","fixedVersion":"17.4.5"},{"ecosystem":"Maven","name":"org.xwiki.platform:xwiki-platform-web-templates","fixedVersion":"17.8.0-rc-1"}],"fix":{"url":"https://github.com/xwiki/xwiki-platform/commit/8337ac8c3b19c37f306723b638b2cae8b0a57dbf","label":"xwiki/xwiki-platform@8337ac8"},"references":[{"type":"WEB","url":"https://github.com/xwiki/xwiki-platform/releases/tag/xwiki-platform-16.10.12"},{"type":"WEB","url":"https://github.com/xwiki/xwiki-platform/releases/tag/xwiki-platform-17.4.5"},{"type":"WEB","url":"https://github.com/xwiki/xwiki-platform/releases/tag/xwiki-platform-17.8.0-rc-1"},{"type":"WEB","url":"https://jira.xwiki.org/browse/XWIKI-23462"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24128.json"},{"type":"ADVISORY","url":"https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-wvqx-m5px-6cmp"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-24128"},{"type":"FIX","url":"https://github.com/xwiki/xwiki-platform/commit/8337ac8c3b19c37f306723b638b2cae8b0a57dbf"},{"type":"WEB","url":"https://github.com/xwiki/xwiki-platform/commit/8337ac8c3b19c37f306723b638b2cae8b0a57dbf#diff-8f16efedd19baae025db602d8736a105bfd8f72676af2c935b8195a0c356ee71"},{"type":"PACKAGE","url":"https://github.com/xwiki/xwiki-platform"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-28T11:10:03.068277896Z"}}