CVE-2026-24128
1 advisory.
Maven/org.xwiki.platform:xwiki-platform-web-templates CVE-2026-24128: medium
XWiki Affected by Reflected Cross-Site Scripting (XSS) in Error Messages
Action: Upgrade org.xwiki.platform:xwiki-platform-web-templates to 16.10.12 (16.10.x), 17.4.5 (17.4.x) or 17.8.0-rc-1 (17.8.x) or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 7.0-milestone-2 | 16.10.12 | - |
| 17.0.0-rc-1 | 17.4.5 | - |
| 17.5.0-rc-1 | 17.8.0-rc-1 | - |
Fixed versions
| 16.10.12 | 17.4.5 | 17.8.0-rc-1 |
Sources
- osv: GHSA-wvqx-m5px-6cmp
- https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-wvqx-m5px-6cmp
- https://nvd.nist.gov/vuln/detail/CVE-2026-24128
- https://github.com/xwiki/xwiki-platform/commit/8337ac8c3b19c37f306723b638b2cae8b0a57dbf
- https://github.com/xwiki/xwiki-platform/commit/8337ac8c3b19c37f306723b638b2cae8b0a57dbf#diff-8f16efedd19baae025db602d8736a105bfd8f72676af2c935b8195a0c356ee71
- https://github.com/xwiki/xwiki-platform
- https://github.com/xwiki/xwiki-platform/releases/tag/xwiki-platform-16.10.12
- https://github.com/xwiki/xwiki-platform/releases/tag/xwiki-platform-17.4.5
- https://github.com/xwiki/xwiki-platform/releases/tag/xwiki-platform-17.8.0-rc-1
- https://jira.xwiki.org/browse/XWIKI-23462
CVE-2026-24128 · published · modified · JSON