It's possible using comments to inject CSS that would transform the full wiki in a link area leading to a malicious page. All versions of XWiki are impacted by this kind of attack.
The problem has been patched not by preventing injecting CSS in comments, which is currently a feature of XWiki, but by requiring confirmation from users when driving them to untrusted domains after clicking on a link, thus preventing any click-jacking attack.
This security measure has been put in place in XWiki 17.9.0, 17.4.6, 16.10.13.
There's no out-of-the-box workaround, but it should be possible to partly reuse the javascript code provided for the security measure in a JSX object inside the wiki, to request the same kind of confirmation.
If you have any questions or comments about this advisory:
* Open an issue in Jira XWiki.org
* Email us at Security Mailing List
Thanks Tomas Keech (Sentrium Security Ltd) for reporting this vulnerability.
| Score | Percentile |
|---|---|
| 0.03% | 9.17% |
| Base score | Version | Severity | Vector |
|---|---|---|---|
| 5.3 | 4.0 | — |
|
| Type | Value |
|---|---|
| GHSA | GHSA-74rh-c5rh-88vg ↗ |
| CVE | CVE-2026-26000 ↗ |
| CWE id | Name |
|---|---|
| CWE-1021 | Improper Restriction of Rendered UI Layers or Frames |
Vulnerable version ranges and first patched releases as published by GitHub.
| Ecosystem | Package | Vulnerable range | First patched | Vulnerable functions |
|---|---|---|---|---|
| maven | org.xwiki.platform:xwiki-platform-web | >= 17.5.0, < 17.9.0 | 17.9.0 | — |
| maven | org.xwiki.platform:xwiki-platform-web | >= 17.0.0-rc-1, < 17.4.6 | 17.4.6 | — |
| maven | org.xwiki.platform:xwiki-platform-web | < 16.10.13 | 16.10.13 | — |