5.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-26000

CVE-2026-26000: XWiki Platform affected by click-jacking through CSS injection in comments

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Prior to 17.9.0, 17.4.6, and 16.10.13, it's possible using comments to inject CSS that would transform the full wiki in a link area leading to a malicious page. This vulnerability is fixed in 17.9.0, 17.4.6, and 16.10.13.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-26000

CVE-2026-26000:

5.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
org.xwiki.platform:xwiki-platform-web	maven	>= 17.5.0, < 17.9.0	17.9.0
org.xwiki.platform:xwiki-platform-web	maven	>= 17.0.0-rc-1, < 17.4.6	17.4.6
org.xwiki.platform:xwiki-platform-web	maven	< 16.10.13	16.10.13

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability allows for click-jacking attacks by injecting CSS into comments. This is possible because XWiki allows CSS in comments as a feature. The vulnerability is not a flaw in a specific function but rather a design choice that can be abused.

The provided patches do not remove the CSS injection capability. Instead, they introduce a client-side security control to mitigate the risk. This control intercepts all clicks on external links and prompts the user for confirmation before navigating to an untrusted domain.

The identified functions are the core components of this new mitigation. The JavaScript functions (askIfLinkNotTrusted, isAnchorTrustedOomain) are executed in the user's browser at the moment a link is clicked, making them direct runtime indicators of the security control. The Java functions (URLSecurityScriptService.*) are executed on the server during page rendering to provide the necessary configuration (trusted domains, allowed URLs) to the client-side script.

Therefore, while these functions are not 'vulnerable' themselves, they are the critical functions related to the patching of this vulnerability and would appear in runtime profiles when the mitigation is active.

Vulnerable functions

askIfLinkNotTrusted

xwiki-platform-core/xwiki-platform-web/xwiki-platform-web-war/src/main/webapp/resources/uicomponents/link/link-protection.js

This function is part of the patch to mitigate the click-jacking vulnerability. It is not vulnerable itself, but it is a key runtime indicator that would appear in a profiler during an attempted exploitation. It intercepts clicks on links and checks if the destination URL is trusted before allowing navigation.

isAnchorTrustedOomain

xwiki-platform-core/xwiki-platform-web/xwiki-platform-web-war/src/main/webapp/resources/uicomponents/link/link-protection.js

This helper function is called by `askIfLinkNotTrusted` to determine if a link's destination is in the list of trusted domains or allowed URLs. It is part of the mitigation and would be in the call stack during the security check.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.