PT-2026-7901 · Xwiki · Xwiki Platform

Keechy1231 · Published 2026-02-12 · Updated 2026-02-20 · CVE-2026-26000

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions XWiki Platform versions prior to 17.9.0 XWiki Platform versions prior to 17.4.6 XWiki Platform versions prior to 16.10.13

Description The XWiki Platform, a generic wiki platform, is affected by a UI redressing issue, specifically a clickjacking attack. This allows unauthenticated attackers to hijack user clicks through CSS injection within comments. By overlaying invisible anchor elements, an attacker can redirect users to malicious pages. The issue stems from improper restriction of visual layers within the user interface. The vulnerability allows for CSS injection using the comment functionality.

Recommendations Update to XWiki Platform version 17.9.0 or later. Update to XWiki Platform version 17.4.6 or later. Update to XWiki Platform version 16.10.13 or later.

Exploit

Fix

Clickjacking

Weakness Enumeration

CWE-1021

Related Identifiers

BDU:2026-02020

CVE-2026-26000

GHSA-74RH-C5RH-88VG

Affected Products

Xwiki Platform

References · 20

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/26xxx/CVE-2026-26000.json · Exploit
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-74rh-c5rh-88vg · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-26000 · Security Note
• https://bdu.fstec.ru/vul/2026-02020 · Security Note
• https://osv.dev/vulnerability/CVE-2026-26000 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-74rh-c5rh-88vg · Vendor Advisory
• https://github.com/xwiki/xwiki-platform · Note
• https://github.com/xwiki/xwiki-platform/commit/7b5a4f8c34d9b1da3d966e17f7dbccabac448e75 · Note
• https://github.com/xwiki/xwiki-platform/commit/29cb81f3a5387cf822d7e7534bdd63903275f86b · Note
• https://github.com/xwiki/xwiki-platform/pull/4645 · Note
• https://github.com/xwiki/xwiki-platform/releases/tag/xwiki-platform-17.4.6 · Note
• https://reddit.com/r/VulnMatter/comments/1r3ppbt/resumen_diario_de_vulnerabilidades_13022026 · Reddit Post
• https://reddit.com/r/VulnMatter/comments/1r3pptr/resumen_diario_de_vulnerabilidades_13022026 · Reddit Post
• https://reddit.com/r/VulnMatter/comments/1r3ozdd/resumen_diario_de_vulnerabilidades_13022026 · Reddit Post
• https://reddit.com/r/VulnMatter/comments/1r3pq3j/resumen_diario_de_vulnerabilidades_13022026 · Reddit Post