XWiki Platform affected by click-jacking through CSS injection in comments (xwiki xwiki-platform)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.32 % · percentile 24 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- GitHub_M
- NVD status
- Analyzed
Description
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Prior to 17.9.0, 17.4.6, and 16.10.13, it's possible using comments to inject CSS that would transform the full wiki in a link area leading to a malicious page. This vulnerability is fixed in 17.9.0, 17.4.6, and 16.10.13.
Weaknesses (CWE)
- CWE-1021 — Improper Restriction of Rendered UI Layers or Frames
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 4.0 | MEDIUM 5.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N | GitHub_M |
| CVSS 4.0 | MEDIUM 5.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X | NVD · security-advisories@github.com (Secondary) |
| CVSS 3.1 | MEDIUM 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N | NVD · nvd@nist.gov (Primary) |
Advisories
- GHSA-74rh-c5rh-88vg — XWiki vulnerable to click-jacking through CSS injection in comments
European references
- ENISA EUVD · EUVD-2026-6694
- GCVE · GCVE-0-2026-26000
Affected configurations (NVD CPE)
cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*< 16.10.13cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*≥ 17.0.0 < 17.4.6cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*≥ 17.5.0 < 17.9.0
Affected products
| Product | Versions |
|---|---|
| xwiki · xwiki-platform | affected >= 17.5.0, < 17.9.0 ; affected >= 17.0.0-rc-1, < 17.4.6 ; affected < 16.10.13 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |