PT-2026-66516 · Apache · Apache Jspwiki

Justin Ng · CVE-2026-48910 · Published 2026-07-30 · Updated 2026-07-30

NVD

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

A carefully crafted editing request could trigger an XSS vulnerability on Apache JSPWiki when parsing errors on the markdown renderer, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim.

This issue affects Apache JSPWiki: through 2.12.3.

Users are recommended to upgrade to version 2.12.4, which fixes the issue.

Fix

XSS

Weakness Enumeration

CWE-80

Related Identifiers

CVE-2026-48910

Affected Products

Apache Jspwiki

References · 3

• https://lists.apache.org/thread/yvbdjnocw5qq3xkbjs9h77ghlg0bsw2c · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-48910 · Security Note
• http://openwall.com/lists/oss-security/2026/07/30/18 · Note