{"id":"CVE-2026-26000","aliases":["EUVD-2026-6694","GHSA-74rh-c5rh-88vg"],"status":"published","title":"XWiki Platform affected by click-jacking through CSS injection in comments","description":"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Prior to 17.9.0, 17.4.6, and 16.10.13, it's possible using comments to inject CSS that would transform the full wiki in a link area leading to a malicious page. This vulnerability is fixed in 17.9.0, 17.4.6, and 16.10.13.","severity":{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00311,"percentile":0.24257,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1021"],"published":"2026-02-12T15:54:19Z","modified":"2026-10-28T02:31:05Z","fixes":[{"ecosystem":"Maven","package":"org.xwiki.platform:xwiki-platform-web","fixed_in":["17.9.0","17.4.6","16.10.13"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.xwiki.platform:xwiki-platform-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17.5.0"},{"fixed":"17.9.0"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.xwiki.platform:xwiki-platform-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17.0.0-rc-1"},{"fixed":"17.4.6"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.xwiki.platform:xwiki-platform-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.10.13"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.xwiki.platform:xwiki-platform-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17.5.0"},{"fixed":"17.9.0"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.xwiki.platform:xwiki-platform-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17.0.0-rc-1"},{"fixed":"17.4.6"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.xwiki.platform:xwiki-platform-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.10.13"}]}]}],"products":[{"vendor":"xwiki","product":"xwiki"},{"vendor":"xwiki","product":"xwiki-platform"}],"references":[{"url":"https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-74rh-c5rh-88vg","tags":["x_refsource_CONFIRM","Patch","Vendor Advisory","advisory","web"]},{"url":"https://github.com/xwiki/xwiki-platform/releases/tag/xwiki-platform-17.4.6","tags":["x_refsource_MISC","Product","Release Notes","web"]},{"url":"https://github.com/xwiki/xwiki-platform/pull/4645","tags":["web"]},{"url":"https://github.com/xwiki/xwiki-platform/commit/29cb81f3a5387cf822d7e7534bdd63903275f86b","tags":["web"]},{"url":"https://github.com/xwiki/xwiki-platform/commit/7b5a4f8c34d9b1da3d966e17f7dbccabac448e75","tags":["web"]},{"url":"https://jira.xwiki.org/browse/XWIKI-23433","tags":["web"]},{"url":"https://www.xwiki.org/xwiki/bin/view/ReleaseNotes/Data/XWiki/17.9.0RC1/Entry006","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-26000","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-74rh-c5rh-88vg"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/26xxx/CVE-2026-26000.json","tags":["advisory"]},{"url":"https://github.com/xwiki/xwiki-platform","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-26000","title":"XWiki Platform affected by click-jacking through CSS injection in comments","description":"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Prior to 17.9.0, 17.4.6, and 16.10.13, it's possible using comments to inject CSS that would transform the full wiki in a link area leading to a malicious page. This vulnerability is fixed in 17.9.0, 17.4.6, and 16.10.13.","status":"published","published":"2026-02-12T20:30:07.263Z","modified":"2026-02-12T20:54:45.754Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"}],"cwes":["CWE-1021"],"updated_at":"2026-11-02T13:38:32.13011Z"}],"euvd":[{"id":"EUVD-2026-6694","description":"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Prior to 17.9.0, 17.4.6, and 16.10.13, it's possible using comments to inject CSS that would transform the full wiki in a link area leading to a malicious page. This vulnerability is fixed in 17.9.0, 17.4.6, and 16.10.13.","status":"published","published":"2026-02-12T20:30:07Z","modified":"2026-02-12T20:54:45Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T19:48:40.418792Z"}],"ghsa":[{"id":"GHSA-74rh-c5rh-88vg","title":"XWiki vulnerable to click-jacking through CSS injection in comments","description":"### Impact\n\nIt's possible using comments to inject CSS that would transform the full wiki in a link area leading to a malicious page. All versions of XWiki are impacted by this kind of attack. \n\n### Patches\n\nThe problem has been patched not by preventing injecting CSS in comments, which is currently a feature of XWiki, but by requiring confirmation from users when driving them to untrusted domains after clicking on a link, thus preventing any click-jacking attack. \nThis security measure has been put in place in XWiki 17.9.0, 17.4.6, 16.10.13.\n\n### Workarounds\n\nThere's no out-of-the-box workaround, but it should be possible to partly reuse [the javascript code provided for the security measure](https://github.com/xwiki/xwiki-platform/blob/xwiki-platform-17.9.0/xwiki-platform-core/xwiki-platform-web/xwiki-platform-web-war/src/main/webapp/resources/uicomponents/link/link-protection.js) in a JSX object inside the wiki, to request the same kind of confirmation. \n\n### References\n  * JIRA ticket: https://jira.xwiki.org/browse/XWIKI-23433\n  * Documentation of the new security measure: https://www.xwiki.org/xwiki/bin/view/ReleaseNotes/Data/XWiki/17.9.0RC1/Entry006/\n  * Commit for the security fix: https://github.com/xwiki/xwiki-platform/commit/29cb81f3a5387cf822d7e7534bdd63903275f86b\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n* Open an issue in [Jira XWiki.org](https://jira.xwiki.org/)\n* Email us at [Security Mailing List](mailto:security@xwiki.org)\n\n### Attribution\n\nThanks Tomas Keech (Sentrium Security Ltd) for reporting this vulnerability.","status":"published","published":"2026-02-12T15:54:19Z","modified":"2026-02-12T22:08:13Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-1021"],"updated_at":"2026-11-02T14:39:24.742346Z"}],"nvd":[{"id":"CVE-2026-26000","description":"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Prior to 17.9.0, 17.4.6, and 16.10.13, it's possible using comments to inject CSS that would transform the full wiki in a link area leading to a malicious page. This vulnerability is fixed in 17.9.0, 17.4.6, and 16.10.13.","status":"published","published":"2026-02-12T21:16:02.99Z","modified":"2026-06-17T10:25:34.443Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-1021"],"updated_at":"2026-11-02T14:12:05.908608Z"}],"osv":[{"id":"CVE-2026-26000","title":"XWiki Platform affected by click-jacking through CSS injection in comments","description":"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Prior to 17.9.0, 17.4.6, and 16.10.13, it's possible using comments to inject CSS that would transform the full wiki in a link area leading to a malicious page. This vulnerability is fixed in 17.9.0, 17.4.6, and 16.10.13.","status":"published","published":"2026-02-12T20:30:07.263Z","modified":"2026-10-28T02:31:05.560281278Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-1021"],"updated_at":"2026-11-02T15:44:59.80315Z"},{"id":"GHSA-74rh-c5rh-88vg","title":"XWiki vulnerable to click-jacking through CSS injection in comments","description":"### Impact\n\nIt's possible using comments to inject CSS that would transform the full wiki in a link area leading to a malicious page. All versions of XWiki are impacted by this kind of attack. \n\n### Patches\n\nThe problem has been patched not by preventing injecting CSS in comments, which is currently a feature of XWiki, but by requiring confirmation from users when driving them to untrusted domains after clicking on a link, thus preventing any click-jacking attack. \nThis security measure has been put in place in XWiki 17.9.0, 17.4.6, 16.10.13.\n\n### Workarounds\n\nThere's no out-of-the-box workaround, but it should be possible to partly reuse [the javascript code provided for the security measure](https://github.com/xwiki/xwiki-platform/blob/xwiki-platform-17.9.0/xwiki-platform-core/xwiki-platform-web/xwiki-platform-web-war/src/main/webapp/resources/uicomponents/link/link-protection.js) in a JSX object inside the wiki, to request the same kind of confirmation. \n\n### References\n  * JIRA ticket: https://jira.xwiki.org/browse/XWIKI-23433\n  * Documentation of the new security measure: https://www.xwiki.org/xwiki/bin/view/ReleaseNotes/Data/XWiki/17.9.0RC1/Entry006/\n  * Commit for the security fix: https://github.com/xwiki/xwiki-platform/commit/29cb81f3a5387cf822d7e7534bdd63903275f86b\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n* Open an issue in [Jira XWiki.org](https://jira.xwiki.org/)\n* Email us at [Security Mailing List](mailto:security@xwiki.org)\n\n### Attribution\n\nThanks Tomas Keech (Sentrium Security Ltd) for reporting this vulnerability.","status":"published","published":"2026-02-12T15:54:19Z","modified":"2026-02-12T22:26:23.787527Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-1021"],"updated_at":"2026-11-02T15:46:40.657155Z"}]}}