VYPR
Get started
← All advisories
Moderate severityOSV Advisory· Published Jan 23, 2026· Updated Jan 26, 2026

XWiki Affected by Reflected Cross-Site Scripting (XSS) in Error Messages

CVE-2026-24128

Description

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Versions 7.0-milestone-2 through 16.10.11, 17.0.0-rc-1 through 17.4.4, and 17.5.0-rc-1 through 17.7.0 contain a reflected Cross-site Scripting (XSS) vulnerability, which allows an attacker to craft a malicious URL and execute arbitrary actions with the same privileges as the victim. If the victim has administrative or programming rights, those rights can be exploited to gain full access to the XWiki installation. This issue has been patched in versions 17.8.0-rc-1, 17.4.5 and 16.10.12. To workaround, the patch can be applied manually, only a single line in templates/logging_macros.vm needs to be changed, no restart is required.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
org.xwiki.platform:xwiki-platform-web-templatesMaven
>= 7.0-milestone-2, < 16.10.1216.10.12
org.xwiki.platform:xwiki-platform-web-templatesMaven
>= 17.0.0-rc-1, < 17.4.517.4.5
org.xwiki.platform:xwiki-platform-web-templatesMaven
>= 17.5.0-rc-1, < 17.8.0-rc-117.8.0-rc-1

Affected products

1
  • Xwiki/Xwiki PlatformOSV
    Range: xwiki-platform-7.3-milestone-2, xwiki-platform-7.4-milestone-1, xwiki-platform-7.4-milestone-2, …

Patches

1
8337ac8c3b19

XWIKI-23462: Some extension IDs in log messages aren't displayed correctly

https://github.com/xwiki/xwiki-platformMichael HamannSep 4, 2025via ghsa
commit
2 files changed · +44 −1
  • xwiki-platform-core/xwiki-platform-web/xwiki-platform-web-templates/src/main/resources/templates/logging_macros.vm+1 −1 modified
    @@ -113,7 +113,7 @@ Caused by: #printThrowable($throwable.cause true)
             #set ($version = $argument.versionConstraint)
           #end
           #set ($_extensionURL = "#getExtensionURL($argument.id, $version)")
-          #set ($_extensionName = $argument)
+          #set ($_extensionName = $!escapetool.xml($argument))
         #end
         #set ($message = "$message<a href=""$_extensionURL"" class=""extension-link"">$_extensionName</a>")
       #elseif ($argument.listIterator())
  • xwiki-platform-core/xwiki-platform-web/xwiki-platform-web-templates/src/test/java/org/xwiki/web/DistributionPageTest.java+43 −0 modified
    @@ -19,23 +19,33 @@
  */
 package org.xwiki.web;
 
+import java.util.List;
+
 import javax.inject.Inject;
 import javax.inject.Named;
 
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
 import org.xwiki.extension.DefaultExtensionDependency;
 import org.xwiki.extension.ExtensionDependency;
+import org.xwiki.extension.ExtensionId;
+import org.xwiki.extension.job.InstallRequest;
+import org.xwiki.extension.job.plan.internal.DefaultExtensionPlan;
 import org.xwiki.extension.script.ExtensionManagerScriptService;
 import org.xwiki.extension.version.internal.DefaultVersionConstraint;
+import org.xwiki.logging.LogQueue;
 import org.xwiki.script.service.ScriptService;
 import org.xwiki.template.TemplateManager;
 import org.xwiki.test.junit5.mockito.MockComponent;
 import org.xwiki.test.page.PageTest;
 
 import static org.hamcrest.MatcherAssert.assertThat;
 import static org.hamcrest.Matchers.containsString;
+import static org.hamcrest.Matchers.matchesRegex;
+import static org.hamcrest.Matchers.not;
 import static org.mockito.Mockito.doReturn;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.verify;
 import static org.mockito.Mockito.when;
 
 /**
@@ -78,4 +88,37 @@ void nonExistingExtensionRequest() throws Exception
                 <span class="extension-name">&#60;test&#62;</span><span
                       class="extension-version">&#60;test&#62;</span>"""));
     }
+
+    @Test
+    void nonExistingExtensionRequestWithJobStatus() throws Exception
+    {
+        String testValue = "<test>";
+        this.stubRequest.put("extensionId", testValue);
+        this.stubRequest.put("extensionVersion", testValue);
+        this.stubRequest.put("extensionSection", "progress");
+        String namespace = "wiki:xwiki";
+        this.stubRequest.put("extensionNamespace", namespace);
+        ExtensionId extensionId = new ExtensionId(testValue, testValue);
+
+        // Mock an extension job status for an installation request with the necessary properties to trigger the
+        // display of the log message.
+        ExtensionManagerScriptService service = (ExtensionManagerScriptService) this.extensionManagerScriptService;
+        InstallRequest installRequest = mock();
+        when(installRequest.getExtensions()).thenReturn(List.of(extensionId));
+        LogQueue logEvents = new LogQueue();
+        logEvents.info("Resolving extension [{}] on namespace [{}]", extensionId, namespace);
+        DefaultExtensionPlan<InstallRequest> extensionPlan = mock();
+        when(extensionPlan.getRequest()).thenReturn(installRequest);
+        when(extensionPlan.getLogTail()).thenReturn(logEvents);
+        when(service.getExtensionPlanJobStatus(testValue, namespace)).thenReturn(extensionPlan);
+
+        String output = this.templateManager.render("distribution.vm");
+
+        verify(service).getExtensionPlanJobStatus(testValue, namespace);
+
+        assertThat(output, containsString("&#60;test&#62;"));
+        assertThat(output, not(containsString(testValue)));
+        assertThat(output, matchesRegex("(?s).*Resolving extension \\[<a href=\"[^\"]*\" class=\"extension-link\">&#60;"
+            + "test&#62;/&#60;test&#62;</a>].*"));
+    }
 }

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

9

News mentions

0

No linked articles in our index yet.