Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in XWiki platform - CVE-2026-40105
Published: May 5, 2026
Vulnerability identifier: #VU129896
CSH Severity: High
CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-40105
CWE-ID: CWE-80
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary JavaScript code in the user's browser.
The vulnerability exists due to improper neutralization of script-related HTML tags in a web page in the page history compare view when handling URL parameters for revision comparison. A remote attacker can send a specially crafted link to execute arbitrary JavaScript code in the user's browser.
If the victim is an administrator, exploitation can affect the confidentiality, integrity, and availability of the whole XWiki instance.
Affected software
XWiki platform
How to mitigate CVE-2026-40105
Install security update from vendor's website.
XWiki platform - addressed in versions 16.10.16, 17.4.8, 17.10.1