XWiki - Cross-Site Scripting
CVE-2026-40105
Verified
Description
XWiki is vulnerable to reflected Cross-Site Scripting (XSS) via the `viewer=changes` endpoint. The `rev2` parameter is not properly sanitised before being rendered in the response, allowing an attacker to inject arbitrary JavaScript. Affects XWiki versions prior to the patched release.
Severity
Medium
CVSS Score
6.1
Exploit Probability
1%
Affected Product
xwiki-platform
Published Date
May 4, 2026
Template Author
ritikchaddha
CVE-2026-40105.yaml
6.1Score
CVSS Metrics
CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVE ID:
cve-2026-40105
CWE ID:
cwe-79
Remediation Steps
Update to a version later than 17.10.0 or apply the patch to templates/changesdoc.vm manually.