VulnSocial

CVE-2026-24128Disclosure(xwiki / xwiki)

LOWCVSS 6.1 · MEDIUM

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft
  • Track advisory updates for patch or workaround availability

Recommended action window: High priority (within 72h)

NVD description

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Versions 7.0-milestone-2 through 16.10.11, 17.0.0-rc-1 through 17.4.4, and 17.5.0-rc-1 through 17.7.0 contain a reflected Cross-site Scripting (XSS) vulnerability, which allows an attacker to craft a malicious URL and execute arbitrary actions with the same privileges as the victim. If the victim has administrative or programming rights, those rights can be exploited to gain full access to the XWiki installation. This issue has been patched in versions 17.8.0-rc-1, 17.4.5 and 16.10.12. To workaround, the patch can be applied manually, only a single line in templates/logging_macros.vm needs to be changed, no restart is required.

xwiki CVEsBack to dashboard
1.5/ 10 priority

Sources & remediation

Patch / fix
Vendor / third-party advisories
Other references
Weakness type (CWE)
CWE-79CWE-80

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • xwiki
  • xwiki-rendering

Threat summary

  • Public PoC is present in monitored signal
  • 1 mentions across 1 observed day

What's happening

  • PoC mentioned or linked in 1 signal
  • Technical details provided in 1 signal
  • Disclosure: 1 classified signal
  • 1 total mentions across 1 day

Affected systems

Vendors
xwiki
Products
xwikixwiki-rendering

3 versions affected across 2 products

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-02-03: 1PoC Mentioned / Linked · 2026-02-03: 1Technical Details · 2026-02-03: 102-03
Signal classification1 categories
Disclosure
1100.0%
Referenced assets1 URL
By indicator
Full discourse1 post
  • pdnuclei-bot@pdnuclei_bot
    Disclosure

    🚨 CVE-2026-24128 - medium 🚨 XWiki Platform Distribution Flavor Main - Cross-Site Scripting > XWiki Platform Distribution Flavor Main versions prior to 17.6.0 are vulnerable to re... 👾 https://cloud.projectdiscovery.io/library/CVE-2026-24128 @pdnuclei #NucleiTemplates #cve

    Post summary

    The post announces CVE‑2026‑24128 as a medium‑severity XSS flaw in XWiki Platform versions before 17.6.0, providing a link to a detection resource but no exploitation or patch information.

    00001182
    890 followersView on X
CPE platform detail5 entries

5 of 5 entries

PartVendorProductVersionTarget SWTarget HW
Appxwikixwiki---
Appxwikixwiki17.0.0--
Appxwikixwiki7.0--
Appxwikixwiki7.0--
Appxwikixwiki-rendering17.5.0--

Explore more

Back to dashboardxwiki CVEsxwiki vulnerabilities