CVE-2026-26000
February 12, 2026
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Prior to 17.9.0, 17.4.6, and 16.10.13, it's possible using comments to inject CSS that would transform the full wiki in a link area leading to a malicious page. This vulnerability is fixed in 17.9.0, 17.4.6, and 16.10.13.
Affected Packages
https://github.com/xwiki/xwiki-platform.git (GITHUB):
Affected version(s) >=xwiki-platform-3.0.1 <xwiki-platform-16.10.13Fix Suggestion:
Update to version xwiki-platform-16.10.13https://github.com/xwiki/xwiki-platform.git (GITHUB):
Affected version(s) >=xwiki-platform-17.0.0 <xwiki-platform-17.4.6Fix Suggestion:
Update to version xwiki-platform-17.4.6https://github.com/xwiki/xwiki-platform.git (GITHUB):
Affected version(s) >=xwiki-platform-17.5.0 <xwiki-platform-17.9.0Fix Suggestion:
Update to version xwiki-platform-17.9.0org.xwiki.platform:xwiki-platform-web (JAVA):
Affected version(s) >=3.1-milestone-1 <16.10.13Fix Suggestion:
Update to version 16.10.13Related Resources (9)
Do you need more information?
Contact UsCVSS v4
Base Score:
5.3
Attack Vector
NETWORK
Attack Complexity
LOW
Attack Requirements
NONE
Privileges Required
NONE
User Interaction
PASSIVE
Vulnerable System Confidentiality
LOW
Vulnerable System Integrity
LOW
Vulnerable System Availability
LOW
Subsequent System Confidentiality
NONE
Subsequent System Integrity
NONE
Subsequent System Availability
NONE
CVSS v3
Base Score:
6.3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality
LOW
Integrity
LOW
Availability
LOW
Weakness Type (CWE)
Improper Restriction of Rendered UI Layers or Frames
EPSS
Base Score:
0.03
