CVE-2026-26000

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-26000
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-26000.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-26000
Aliases
Published
2026-02-12T20:30:07.263Z
Modified
2026-02-16T00:35:21.937760Z
Severity
  • 5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N CVSS Calculator
Summary
XWiki Platform affected by click-jacking through CSS injection in comments
Details

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Prior to 17.9.0, 17.4.6, and 16.10.13, it's possible using comments to inject CSS that would transform the full wiki in a link area leading to a malicious page. This vulnerability is fixed in 17.9.0, 17.4.6, and 16.10.13.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/26xxx/CVE-2026-26000.json",
    "cwe_ids": [
        "CWE-1021"
    ],
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/xwiki/xwiki-platform

Affected ranges

Type
GIT
Repo
https://github.com/xwiki/xwiki-platform
Events
Introduced
b85d21efede0f7c07c04c5ad5fb7610be0866096
Fixed
6d779a871d57c6084484b558b037f0bdc7610ef3
Database specific 
{
    "versions": [
        {
            "introduced": "17.5.0"
        },
        {
            "fixed": "17.9.0"
        }
    ]
}
Type
GIT
Repo
https://github.com/xwiki/xwiki-platform
Events
Introduced
445c0831fb8cf5610eda0eb58225890cb2bece6c
Fixed
65f1319fa7c99b829cdb9d3697ed9bd86ca10db5
Database specific 
{
    "versions": [
        {
            "introduced": "17.0.0-rc-1"
        },
        {
            "fixed": "17.4.6"
        }
    ]
}
Type
GIT
Repo
https://github.com/xwiki/xwiki-platform
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
72c4c44e7f0b794a6a0da507b0802b0f352c08ca
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "16.10.13"
        }
    ]
}

Affected versions

xwiki-application-calendar-1.*
xwiki-application-calendar-1.0
xwiki-platform-16.*
xwiki-platform-16.10.0
xwiki-platform-16.10.0-rc-1
xwiki-platform-16.10.1
xwiki-platform-16.10.10
xwiki-platform-16.10.11
xwiki-platform-16.10.12
xwiki-platform-16.10.2
xwiki-platform-16.10.3
xwiki-platform-16.10.4
xwiki-platform-16.10.5
xwiki-platform-16.10.6
xwiki-platform-16.10.7
xwiki-platform-16.10.8
xwiki-platform-16.10.9
xwiki-platform-7.*
xwiki-platform-7.3-milestone-2
xwiki-platform-7.4-milestone-1
xwiki-platform-7.4-milestone-2
xwiki-platform-8.*
xwiki-platform-8.0-milestone-1
xwiki-platform-8.0-milestone-2
xwiki-platform-8.1-milestone-1
xwiki-platform-8.1-milestone-2
xwiki-platform-8.2-milestone-1
xwiki-platform-8.2-milestone-2
xwiki-platform-8.3-milestone-1
xwiki-platform-9.*
xwiki-platform-9.9-rc-2
xwiki-plugin-tag-1.*
xwiki-plugin-tag-1.1

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-26000.json"