CVE-2026-24128
📋 TL;DR
This reflected XSS vulnerability in XWiki Platform allows attackers to craft malicious URLs that execute arbitrary JavaScript in victims' browsers. If victims have administrative or programming rights, attackers can gain full control of the XWiki installation. Affected versions include 7.0-milestone-2 through 16.10.11, 17.0.0-rc-1 through 17.4.4, and 17.5.0-rc-1 through 17.7.0.
💻 Affected Systems
- XWiki Platform
📦 What is this software?
Xwiki by Xwiki
Xwiki by Xwiki
Xwiki by Xwiki
Xwiki by Xwiki
Xwiki by Xwiki
Xwiki by Xwiki
⚠️ Risk & Real-World Impact
Worst Case
Full compromise of XWiki installation with administrative privileges, allowing data theft, system takeover, and lateral movement.
Likely Case
Session hijacking, credential theft, and privilege escalation for authenticated users.
If Mitigated
Limited impact if victims have minimal privileges and proper input validation is enforced elsewhere.
🎯 Exploit Status
Reflected XSS vulnerabilities are commonly weaponized. Attack requires victim to click malicious link.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 16.10.12, 17.4.5, 17.8.0-rc-1
Vendor Advisory: https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-wvqx-m5px-6cmp
Restart Required: No
Instructions:
1. Upgrade to patched version: 16.10.12, 17.4.5, or 17.8.0-rc-1. 2. Apply manual patch to templates/logging_macros.vm if upgrading not possible.
🔧 Temporary Workarounds
Manual template patch
allApply single-line fix to templates/logging_macros.vm file as shown in GitHub commit.
Edit templates/logging_macros.vm and apply fix from: https://github.com/xwiki/xwiki-platform/commit/8337ac8c3b19c37f306723b638b2cae8b0a57dbf
🧯 If You Can't Patch
- Implement WAF rules to block XSS payloads in URLs
- Restrict user privileges to minimize impact if exploited
🔍 How to Verify
Check if Vulnerable:
Check XWiki version against affected ranges. Test for XSS in logging templates.Check Version:
Check XWiki administration panel or xwiki.cfg file for version.Verify Fix Applied:
Verify version is 16.10.12, 17.4.5, or 17.8.0-rc-1+. Test that XSS payloads no longer execute.📡 Detection & Monitoring
Log Indicators:
- Unusual URL parameters with script tags or JavaScript in access logs
- Multiple failed XSS attempts
Network Indicators:
- HTTP requests containing XSS payloads in URL parameters
SIEM Query:
url:*script* OR url:*javascript* OR url:*onerror* OR url:*onload*🔗 References
- https://github.com/xwiki/xwiki-platform/commit/8337ac8c3b19c37f306723b638b2cae8b0a57dbf
- https://github.com/xwiki/xwiki-platform/releases/tag/xwiki-platform-16.10.12
- https://github.com/xwiki/xwiki-platform/releases/tag/xwiki-platform-17.4.5
- https://github.com/xwiki/xwiki-platform/releases/tag/xwiki-platform-17.8.0-rc-1
- https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-wvqx-m5px-6cmp
- https://jira.xwiki.org/browse/XWIKI-23462
