Skip to content
brandefense.io
Request A Demo
Vulnerability Intelligence

CVE-2026-24128

Medium

XWiki Affected by Reflected Cross-Site Scripting (XSS) in Error Messages

Published Jan 23, 2026 · Updated Aug 12, 2026 · Also known as GHSA-wvqx-m5px-6cmp

Key Facts

Routine patching
  • CVE-2026-24128 is a medium-severity vulnerability (CVSS 6.5 v4) affecting Xwiki, Xwiki-Rendering, org.xwiki.platform:xwiki-platform-web-templates (maven) and 1 more product.
  • It is not listed in any known-exploited vulnerabilities catalog. No public exploit code is known.
  • EPSS estimates a 0.6% probability of exploitation in the next 30 days.
  • Fixed versions are available, including org.xwiki.platform:xwiki-platform-web-templates 16.10.12, org.xwiki.platform:xwiki-platform-web-templates 17.4.5, org.xwiki.platform:xwiki-platform-web-templates 17.8.0-rc-1.
  • Brandefense priority: routine patching, as no exploitation is known and its severity is moderate or low.

CVSS v4

6.5

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS (30-day exploit likelihood)

0.6%

Higher than 45.3% of all scored CVEs

Exploited in the wild

No known

Not in a known-exploited catalog

Public exploit code

None known

Get the full CVE-2026-24128 brief as a PDF

Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.

Description

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Versions 7.0-milestone-2 through 16.10.11, 17.0.0-rc-1 through 17.4.4, and 17.5.0-rc-1 through 17.7.0 contain a reflected Cross-site Scripting (XSS) vulnerability, which allows an attacker to craft a malicious URL and execute arbitrary actions with the same privileges as the victim. If the victim has administrative or programming rights, those rights can be exploited to gain full access to the XWiki installation.

This issue has been patched in versions 17.8.0-rc-1, 17.4.5 and 16.10.12. To workaround, the patch can be applied manually, only a single line in templates/logging_macros.vm needs to be changed, no restart is required.

Affected Products

7 affected entries in total
ProductAffected versionsFixed in
XwikiXwiki17.0.0-rc1, 7.0-milestone2, 7.0-rc116.10.12
Xwiki-RenderingXwiki17.5.0-rc1n/a
org.xwiki.platform:xwiki-platform-web-templatesmaven>= 7.0-milestone-217.8.0-rc-1
xwiki-platform>= >= 7.0-milestone-2, < 16.10.12n/a

Patched Releases

org.xwiki.platform:xwiki-platform-web-templates

16.10.12, 17.4.5, 17.8.0-rc-1

Xwiki

16.10.12

Timeline

  1. Publicly disclosed

    Jan 23, 2026

  2. Last updated

    Aug 12, 2026

Weakness Type

  • CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
  • CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

References

6 more references in the full CVE brief

FAQ

Common Questions.

Is CVE-2026-24128 Running On Your Attack Surface?

Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.

Request A Demo