6.5

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-24128

CVE-2026-24128: XWiki Affected by Reflected Cross-Site Scripting (XSS) in Error Messages

Impact

A reflected cross site scripting (XSS) vulnerability in XWiki allows an attacker to execute arbitrary actions in XWiki with the rights of the victim if the attacker manages to trick a victim into visiting a crafted URL. If the victim has administrative or programming rights, those rights can be exploited to gain full access to the XWiki installation.

Patches

This vulnerability has been patched in XWiki 17.8.0RC1, 17.4.5 and 16.10.12.

Workarounds

The patch can be applied manually, only a single line in templates/logging_macros.vm needs to be changed, no restart is required.

References

https://github.com/xwiki/xwiki-platform/commit/8337ac8c3b19c37f306723b638b2cae8b0a57dbf
https://jira.xwiki.org/browse/XWIKI-23462

Attribution

We thank Mike Cole @mikecole-mg for discovering and reporting this vulnerability.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-24128

CVE-2026-24128:

6.5

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
org.xwiki.platform:xwiki-platform-web-templates	maven	>= 7.0-milestone-2, < 16.10.12	16.10.12
org.xwiki.platform:xwiki-platform-web-templates	maven	>= 17.0.0-rc-1, < 17.4.5	17.4.5
org.xwiki.platform:xwiki-platform-web-templates	maven	>= 17.5.0-rc-1, < 17.8.0-rc-1	17.8.0-rc-1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The analysis of the provided patch commit reveals a reflected XSS vulnerability in a Velocity template (logging_macros.vm). The vulnerability lies in the failure to escape an argument variable before it is rendered as part of an HTML link. The commit introduces a fix by using $!escapetool.xml() to properly sanitize this variable. Although the vulnerability is within a template file, the function responsible for processing this template and producing the vulnerable HTML output is org.xwiki.template.TemplateManager.render. The associated test file changes confirm that rendering the distribution.vm template, which utilizes the vulnerable macro, is the path to trigger this vulnerability. Therefore, org.xwiki.template.TemplateManager.render is the key function that would appear in a runtime profile during the exploitation of this XSS vulnerability.

Vulnerable functions

org.xwiki.template.TemplateManager.render

xwiki-platform-core/xwiki-platform-web/xwiki-platform-web-templates/src/main/resources/templates/logging_macros.vm

The vulnerability is a reflected Cross-Site Scripting (XSS) issue within a Velocity template macro located in `logging_macros.vm`. The macro failed to properly escape the `$argument` variable, which represents an extension ID and can be controlled by an attacker through a crafted URL. When rendering a page that displays extension-related log messages (such as `distribution.vm`), the `TemplateManager.render` function processes this vulnerable macro. An attacker could provide a malicious extension ID containing HTML and script tags, which would then be rendered unescaped into the page, leading to XSS. The patch fixes this by using `$!escapetool.xml()` to sanitize the extension name before it is embedded in the HTML.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

6.5

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2026-24128: XWiki Affected by Reflected Cross-Site Scripting (XSS) in Error Messages

Impact

Patches

Workarounds

References

Attribution

CVE-2026-24128:

6.5

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

6.5

6.5

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Basic Information

Basic Information

CVE-2026-24128: XWiki Affected by Reflected Cross-Site Scripting (XSS) in Error Messages

Impact

Patches

Workarounds

References

Attribution

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI