CVE-2026-40105

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-40105
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-40105.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-40105
Aliases
Published
2026-04-15T00:07:23.150Z
Modified
2026-07-15T01:48:57.091533972Z
Severity
  • 6.5 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H CVSS Calculator
Summary
XWiki has Reflected Cross-Site Scripting (XSS) in its page history compare functionality
Details

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Versions 10.4-rc-1, through 16.10.15, 17.0.0-rc-1, through 17.4.7 and 17.5.0-rc-1 through 17.10.0 contain a reflected cross-site scripting vulnerability (XSS) in the comparison view between revisions of a page allows executing JavaScript code in the user's browser. If the current user is an admin, this can not only affect the current user but also the confidentiality, integrity and availability of the whole XWiki instance. If developers are unable to update immediately, they can apply the patch manually to templates/changesdoc.vm in the deployed WAR.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40105.json",
    "cwe_ids": [
        "CWE-80"
    ],
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/xwiki/xwiki-commons

Affected ranges

Type
GIT
Repo
https://github.com/xwiki/xwiki-commons
Events
Introduced
791f68dfb6acc117a0fc724de2dd2ff140b8d739
Fixed
f5d882bc97f326e1a4847aace42c60fe7cba0f41
Introduced
e84d9bd1b4c0c8219597e10acfd8fbd692416294
Fixed
7ea92428b2dcec895366796ea6d211c01044257f
Introduced
0f12307c8803e5abd5fe7016bd0adf0850c5f903
Fixed
7b786a82160aed48172815cc1b7a66d46f7e5cc9
Database specific 
{
    "cpe": "cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*",
    "source": "CPE_RANGE",
    "extracted_events": [
        {
            "introduced": "10.4"
        },
        {
            "fixed": "16.10.16"
        },
        {
            "introduced": "17.0.0"
        },
        {
            "fixed": "17.4.8"
        },
        {
            "introduced": "17.5.0"
        },
        {
            "fixed": "17.10.1"
        }
    ]
}
Type
GIT
Repo
https://github.com/xwiki/xwiki-platform
Events
Introduced
3127288ac37e080c52f561a1fd7c91a874371f0d
Fixed
12682112b51aa67f5acafa5398193b69adf229f7
Introduced
7edb5b7d98170ec081c7e30237971d7dfb8a4401
Fixed
617c215853ac7649119d019d085e739f5b2b89a8
Introduced
b85d21efede0f7c07c04c5ad5fb7610be0866096
Fixed
a44c0b52377470cd7b597f0e920cfbc85cf043e1
Fixed
3c8a2ec985641367015c2db937574fcd360c788c
Database specific 
{
    "cpe": "cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*",
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "10.4"
        },
        {
            "fixed": "16.10.16"
        },
        {
            "introduced": "17.0.0"
        },
        {
            "fixed": "17.4.8"
        },
        {
            "introduced": "17.5.0"
        },
        {
            "fixed": "17.10.1"
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-40105.json"