PT-2026-4526 · Xwiki · Xwiki Platform

Mikecole-Mg · Published 2026-01-23 · Updated 2026-02-12 · CVE-2026-24128

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions XWiki Platform versions 7.0-milestone-2 through 16.10.11 XWiki Platform versions 17.0.0-rc-1 through 17.4.4 XWiki Platform versions 17.5.0-rc-1 through 17.7.0

Description The XWiki Platform contains a reflected Cross-site Scripting (XSS) issue. This allows an attacker to create a malicious URL that, when visited by a victim, can execute arbitrary actions with the same privileges as the victim. If the victim has administrative or programming rights, an attacker could gain full access to the XWiki installation. The issue resides in the platform's logging infrastructure, allowing attackers to inject malicious scripts via crafted extension identifiers.

Recommendations XWiki Platform versions 7.0-milestone-2 through 16.10.11: Update to version 16.10.12 or later. XWiki Platform versions 17.0.0-rc-1 through 17.4.4: Update to version 17.4.5 or later. XWiki Platform versions 17.5.0-rc-1 through 17.7.0: Update to version 17.8.0-rc-1 or later. As a workaround, manually apply the patch by changing a single line in the templates/logging macros.vm file. No restart is required.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

CWE-80

Related Identifiers

BDU:2026-00973

CVE-2026-24128

GHSA-WVQX-M5PX-6CMP

Affected Products

Xwiki Platform

References · 19

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24128.json · Exploit
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-wvqx-m5px-6cmp · Vendor Advisory
• https://github.com/xwiki/xwiki-platform/commit/8337ac8c3b19c37f306723b638b2cae8b0a57dbf · Patch
• https://jira.xwiki.org/browse/XWIKI-23462 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-24128 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-24128 · Security Note
• https://osv.dev/vulnerability/GHSA-wvqx-m5px-6cmp · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-00973 · Security Note
• https://github.com/xwiki/xwiki-platform · Note
• https://github.com/xwiki/xwiki-platform/releases/tag/xwiki-platform-17.4.5 · Note
• https://github.com/xwiki/xwiki-platform/releases/tag/xwiki-platform-17.8.0-rc-1 · Note
• https://github.com/xwiki/xwiki-platform/commit/8337ac8c3b19c37f306723b638b2cae8b0a57dbf#diff-8f16efedd19baae025db602d8736a105bfd8f72676af2c935b8195a0c356ee71 · Note
• https://github.com/xwiki/xwiki-platform/releases/tag/xwiki-platform-16.10.12 · Note
• https://twitter.com/pdnuclei_bot/status/2018474555149594734 · Twitter Post
• https://twitter.com/_cvereports/status/2014739980069872099 · Twitter Post