CVE-2026-40105 XWiki has Reflected Cross-Site Scripting (XSS) in its page history compare functionality
Attackers can execute JavaScript in users' browsers via reflected XSS in page history comparison, potentially compromising admin accounts and the entire instance.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-40105?
CVE-2026-40105 is a medium-severity cross-site scripting vulnerability in Xwiki Xwiki, published on 15 Apr 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Versions 10.4-rc-1, through 16.10.15, 17.0.0-rc-1, through 17.4.7 and 17.5.0-rc-1 through 17.10.0 contain a reflected cross-site scripting vulnerability (XSS) in the comparison view between revisions of a page allows executing JavaScript code in the user's browser. If the current user is an admin, this can not only affect the current user but also the confidentiality, integrity and availability of the whole XWiki instance. If developers are unable to update immediately, they can apply the patch manually to templates/changesdoc.vm in the deployed WAR.
Weakness: CWE-80
Which versions are affected by CVE-2026-40105?
6 open source packages ship an affected version, including org.xwiki.platform:xwiki-platform-web-templates. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.xwiki.platform:xwiki-platform-web-templates Maven | From 10.4-rc-1 | 16.10.16 |
org.xwiki.platform:xwiki-platform-web-templates Maven | From 10.4-rc-1 | 16.10.16 |
org.xwiki.platform:xwiki-platform-web-templates Maven | From 17.0.0-rc-1 | 17.4.8 |
org.xwiki.platform:xwiki-platform-web-templates Maven | From 17.0.0-rc-1 | 17.4.8 |
org.xwiki.platform:xwiki-platform-web-templates Maven | From 17.5.0-rc-1 | 17.10.1 |
org.xwiki.platform:xwiki-platform-web-templates Maven | From 17.5.0-rc-1 | 17.10.1 |
Products include Xwiki Xwiki.
How do I fix CVE-2026-40105?
Upgrade org.xwiki.platform:xwiki-platform-web-templates to a fixed version for your release line: 16.10.16, 17.4.8 or 17.10.1.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-40105 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-40105 exists.
Public exploit code: 1 Nuclei template.
Other vulnerabilities in Xwiki Xwiki
- CVE-2025-24893 XWiki Platform Eval Injection
- CVE-2025-53836 XWiki Rendering is vulnerable to RCE attacks when processing nested macros
- CVE-2024-55662 XWiki allows remote code execution through the extension sheet
- CVE-2024-55877 XWiki allows remote code execution from account through macro descriptions and XWiki.XWikiSyntaxMacrosList
- CVE-2024-37901 XWiki Platform vulnerable to remote code execution from account via SearchSuggestConfigSheet
Sources
Also known as GHSA-w4fj-87j5-f25c.