Vulnerability · Published Feb 12, 2026 · Assigned by GitHub_M
CVE-2026-26000XWiki Platform affected by click-jacking through CSS injection in comments
Medium 5.3
In plain English
A medium-severity security flaw in xwiki-platform from xwiki. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 25% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Prior to 17.9.0, 17.4.6, and 16.10.13, it's possible using comments to inject CSS that would transform the full wiki in a link area leading to a malicious page. This vulnerability is fixed in 17.9.0, 17.4.6, and 16.10.13.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.xwiki.platform:xwiki-platform-web | 17.9.0 | GHSA-74rh-c5rh-88vg |
| Maven | org.xwiki.platform:xwiki-platform-web | 17.4.6 | GHSA-74rh-c5rh-88vg |
| Maven | org.xwiki.platform:xwiki-platform-web | 16.10.13 | GHSA-74rh-c5rh-88vg |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| xwiki | xwiki-platform | >= 17.5.0, < 17.9.0>= 17.0.0-rc-1, < 17.4.6< 16.10.13 |
Weakness: CWE-1021 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N