XWiki xwiki-platform up to 16.10.11/17.4.4/17.7.x logging_macros.vm cross site scripting

Summaryinfo

A vulnerability, which was classified as problematic, has been found in XWiki xwiki-platform up to 16.10.11/17.4.4/17.7.x. Impacted is an unknown function of the file templates/logging_macros.vm. This manipulation causes cross site scripting. This vulnerability is handled as CVE-2026-24128. The attack can be initiated remotely. There is not any exploit available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability classified as problematic was found in XWiki xwiki-platform up to 16.10.11/17.4.4/17.7.x. Affected by this vulnerability is an unknown functionality of the file templates/logging_macros.vm. The manipulation with an unknown input leads to a cross site scripting vulnerability. The CWE definition for the vulnerability is CWE-79. The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. As an impact it is known to affect integrity. The summary by CVE is:

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Versions 7.0-milestone-2 through 16.10.11, 17.0.0-rc-1 through 17.4.4, and 17.5.0-rc-1 through 17.7.0 contain a reflected Cross-site Scripting (XSS) vulnerability, which allows an attacker to craft a malicious URL and execute arbitrary actions with the same privileges as the victim. If the victim has administrative or programming rights, those rights can be exploited to gain full access to the XWiki installation. This issue has been patched in versions 17.8.0-rc-1, 17.4.5 and 16.10.12. To workaround, the patch can be applied manually, only a single line in templates/logging_macros.vm needs to be changed, no restart is required.

The advisory is shared at github.com. This vulnerability is known as CVE-2026-24128 since 01/21/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. It demands that the victim is doing some kind of user interaction. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1059.007 for this issue.

Upgrading to version 16.10.12, 17.4.5 or 17.8.0-rc-1 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Content Management System

Vendor

• XWiki

Name

• xwiki-platform

Version

• 16.10.0
• 16.10.1
• 16.10.2
• 16.10.3
• 16.10.4
• 16.10.5
• 16.10.6
• 16.10.7
• 16.10.8
• 16.10.9
• 16.10.10
• 16.10.11
• 17.0
• 17.1
• 17.2
• 17.3
• 17.4
• 17.4.0
• 17.4.1
• 17.4.2
• 17.4.3
• 17.4.4
• 17.5
• 17.6
• 17.7

License

• open-source

Website

• Product: https://github.com/xwiki/xwiki-platform/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion