CVE-2026-24128 Details.
XWiki Platform Distribution Flavor Main - Cross-Site Scripting
Atlas does not check this one. Works by exploiting the flaw.
The only reliable test for this one is to try the weakness itself, which can disturb the site. Atlas does not do that, so it does not run this check.
About CVE-2026-24128. What It Means.
XWiki Platform Distribution Flavor Main versions prior to 17.6.0 are vulnerable to reflected cross-site scripting (XSS) due to improper sanitization of user-supplied input in the extensionId parameter. An attacker can exploit this issue by injecting malicious JavaScript, which will be executed in the context of the victim's browser, potentially leading to session hijacking or other attacks.
Affected Product. What Is Hit.
- Vendor
- xwiki
- Product
- XWiki Platform Distribution Flavor Main
References. Where To Read More.
FAQ
Common Questions.
XWiki Platform Distribution Flavor Main - Cross-Site Scripting. XWiki Platform Distribution Flavor Main versions prior to 17.6.0 are vulnerable to reflected cross-site scripting (XSS) due to improper sanitization of user-supplied input in the extensionId parameter. An attacker can exploit this issue by injecting malicious JavaScript, which will be executed in the context of the victim's browser, potentially leading to session hijacking or other attacks.
No. The only reliable test for this one is to try the weakness itself, which can disturb the site. Atlas does not do that, so it does not run this check. The facts about CVE-2026-24128 are on this page, and you can request a demo to see how Brandefense watches your whole external attack surface.
CVE-2026-24128 is not on the CISA Known Exploited Vulnerabilities list at the time of writing, but it is still worth fixing.
Update XWiki Platform Distribution Flavor Main to the latest version from the vendor, or follow the vendor's advice to switch off the affected feature. Vendor links are listed on this page when they are known.
This page lists the public facts about CVE-2026-24128. Atlas does not run a check for it, so nothing here says whether a particular site is affected.