CVE-2026-40105: CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in xwiki xwiki-platform
CVE-2026-40105 is a reflected cross-site scripting (XSS) vulnerability in the XWiki Platform affecting versions from 10. 4-rc-1 up to but not including 16. 10. 16, versions 17. 0. 0-rc-1 up to 17. 4. 8, and versions 17. 5. 0-rc-1 up to 17.
AI Analysis
Technical Summary
This vulnerability is a reflected XSS (CWE-80) in the XWiki Platform's page revision comparison view. It allows injection and execution of arbitrary JavaScript code in the context of the victim's browser. The affected versions include multiple release ranges from 10.4-rc-1 through 17.10.0, excluding certain patch versions. The vulnerability is particularly critical if the victim is an administrator, as it could compromise the entire XWiki instance. The vulnerability can be mitigated by applying a manual patch to the templates/changesdoc.vm file in the deployed WAR if immediate upgrade is not possible. No official patch or remediation level is documented in the provided data.
Potential Impact
Successful exploitation allows execution of arbitrary JavaScript in the user's browser via the page revision comparison view. For administrator users, this can lead to compromise of the confidentiality, integrity, and availability of the entire XWiki instance. The vulnerability does not require privileges or user interaction beyond visiting a crafted URL. No known exploits in the wild have been reported.
Mitigation Recommendations
No official patch or vendor advisory is referenced in the provided data. Developers and administrators should upgrade to versions beyond the affected ranges (i.e., versions 16.10.16, 17.4.8, or 17.10.1 and later) once available. Until then, a manual patch can be applied to the templates/changesdoc.vm file in the deployed WAR to mitigate the vulnerability. Monitor the vendor's official channels for an official fix or advisory.
CVE-2026-40105: CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in xwiki xwiki-platform
Description
CVE-2026-40105 is a reflected cross-site scripting (XSS) vulnerability in the XWiki Platform affecting versions from 10. 4-rc-1 up to but not including 16. 10. 16, versions 17. 0. 0-rc-1 up to 17. 4. 8, and versions 17. 5. 0-rc-1 up to 17.
CVSS v4.0
Score 6.5medium
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability is a reflected XSS (CWE-80) in the XWiki Platform's page revision comparison view. It allows injection and execution of arbitrary JavaScript code in the context of the victim's browser. The affected versions include multiple release ranges from 10.4-rc-1 through 17.10.0, excluding certain patch versions. The vulnerability is particularly critical if the victim is an administrator, as it could compromise the entire XWiki instance. The vulnerability can be mitigated by applying a manual patch to the templates/changesdoc.vm file in the deployed WAR if immediate upgrade is not possible. No official patch or remediation level is documented in the provided data.
Potential Impact
Successful exploitation allows execution of arbitrary JavaScript in the user's browser via the page revision comparison view. For administrator users, this can lead to compromise of the confidentiality, integrity, and availability of the entire XWiki instance. The vulnerability does not require privileges or user interaction beyond visiting a crafted URL. No known exploits in the wild have been reported.
Mitigation Recommendations
No official patch or vendor advisory is referenced in the provided data. Developers and administrators should upgrade to versions beyond the affected ranges (i.e., versions 16.10.16, 17.4.8, or 17.10.1 and later) once available. Until then, a manual patch can be applied to the templates/changesdoc.vm file in the deployed WAR to mitigate the vulnerability. Monitor the vendor's official channels for an official fix or advisory.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-04-09T01:41:38.536Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 69dee70482d89c981fce52d8
Added to database: 4/15/2026, 1:16:52 AM
Last enriched: 4/22/2026, 6:45:21 AM
Last updated: 5/30/2026, 11:35:21 PM
Views: 93
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.