CVE-2026-26000

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-26000", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-09T17:41:55.859Z", "datePublished": "2026-02-12T20:30:07.263Z", "dateUpdated": "2026-02-12T20:54:45.754Z"}, "containers": {"cna": {"title": "XWiki Platform affected by click-jacking through CSS injection in comments", "problemTypes": [{"descriptions": [{"cweId": "CWE-1021", "lang": "en", "description": "CWE-1021: Improper Restriction of Rendered UI Layers or Frames", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-74rh-c5rh-88vg", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-74rh-c5rh-88vg"}, {"name": "https://github.com/xwiki/xwiki-platform/releases/tag/xwiki-platform-17.4.6", "tags": ["x_refsource_MISC"], "url": "https://github.com/xwiki/xwiki-platform/releases/tag/xwiki-platform-17.4.6"}], "affected": [{"vendor": "xwiki", "product": "xwiki-platform", "versions": [{"version": ">= 17.5.0, < 17.9.0", "status": "affected"}, {"version": ">= 17.0.0-rc-1, < 17.4.6", "status": "affected"}, {"version": "< 16.10.13", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-12T20:30:07.263Z"}, "descriptions": [{"lang": "en", "value": "XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Prior to 17.9.0, 17.4.6, and 16.10.13, it's possible using comments to inject CSS that would transform the full wiki in a link area leading to a malicious page. This vulnerability is fixed in 17.9.0, 17.4.6, and 16.10.13."}], "source": {"advisory": "GHSA-74rh-c5rh-88vg", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-12T20:54:20.382398Z", "id": "CVE-2026-26000", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-12T20:54:45.754Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-26000", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-12T20:54:20.382398Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-12T20:54:22.760Z"}}], "cna": {"title": "XWiki Platform affected by click-jacking through CSS injection in comments", "source": {"advisory": "GHSA-74rh-c5rh-88vg", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW"}}], "affected": [{"vendor": "xwiki", "product": "xwiki-platform", "versions": [{"status": "affected", "version": ">= 17.5.0, < 17.9.0"}, {"status": "affected", "version": ">= 17.0.0-rc-1, < 17.4.6"}, {"status": "affected", "version": "< 16.10.13"}]}], "references": [{"url": "https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-74rh-c5rh-88vg", "name": "https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-74rh-c5rh-88vg", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/xwiki/xwiki-platform/releases/tag/xwiki-platform-17.4.6", "name": "https://github.com/xwiki/xwiki-platform/releases/tag/xwiki-platform-17.4.6", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Prior to 17.9.0, 17.4.6, and 16.10.13, it's possible using comments to inject CSS that would transform the full wiki in a link area leading to a malicious page. This vulnerability is fixed in 17.9.0, 17.4.6, and 16.10.13."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1021", "description": "CWE-1021: Improper Restriction of Rendered UI Layers or Frames"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-12T20:30:07.263Z"}}}, "cveMetadata": {"cveId": "CVE-2026-26000", "state": "PUBLISHED", "dateUpdated": "2026-02-12T20:54:45.754Z", "dateReserved": "2026-02-09T17:41:55.859Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-12T20:30:07.263Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "xwiki-platform", "vendor": "xwiki", "versions": [{"status": "affected", "version": ">= 17.5.0, < 17.9.0"}, {"status": "affected", "version": ">= 17.0.0-rc-1, < 17.4.6"}, {"status": "affected", "version": "< 16.10.13"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*", "matchCriteriaId": "BD27F4BE-5B60-4344-AABC-5B0ACB0979B0", "versionEndExcluding": "16.10.13", "vulnerable": true}, {"criteria": "cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*", "matchCriteriaId": "B4E1AB52-A76A-42E2-B103-B57336D534A3", "versionEndExcluding": "17.4.6", "versionStartIncluding": "17.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*", "matchCriteriaId": "7B71A850-0DFE-4298-BF53-2AF0D6A0DBC3", "versionEndExcluding": "17.9.0", "versionStartIncluding": "17.5.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Prior to 17.9.0, 17.4.6, and 16.10.13, it's possible using comments to inject CSS that would transform the full wiki in a link area leading to a malicious page. This vulnerability is fixed in 17.9.0, 17.4.6, and 16.10.13."}, {"lang": "es", "value": "La Plataforma XWiki es una plataforma wiki gen\u00e9rica que ofrece servicios en tiempo de ejecuci\u00f3n para aplicaciones construidas sobre ella. Antes de las versiones 17.9.0, 17.4.6 y 16.10.13, era posible, usando comentarios, inyectar CSS que transformar\u00eda toda la wiki en un \u00e1rea de enlaces que llevar\u00eda a una p\u00e1gina maliciosa. Esta vulnerabilidad est\u00e1 corregida en las versiones 17.9.0, 17.4.6 y 16.10.13."}], "id": "CVE-2026-26000", "lastModified": "2026-06-17T10:25:34.443", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-26000", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-12T20:54:20.382398Z", "version": "2.0.3"}}]}, "published": "2026-02-12T21:16:02.990", "references": [{"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/xwiki/xwiki-platform/releases/tag/xwiki-platform-17.4.6"}, {"source": "security-advisories@github.com", "tags": ["Patch", "Vendor Advisory"], "url": "https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-74rh-c5rh-88vg"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-1021"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[17.5.0,17.9.0)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[17.0.0-rc-1,17.4.6)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,16.10.13)"}}], "product": "xwiki-platform", "vendor": "xwiki"}], "analysis": {"en": {"generated_at": "2026-04-17T19:58:38.434641+00:00", "value": {"mitigation_remediation": ["Update XWiki Platform to version 17.9.0, 17.4.6, or 16.10.13 to apply the vendor\u2011issued CSS injection fix.", "Configure comment handling to disallow or sanitize inline CSS, ensuring that only safe styles are permitted in user\u2011generated content.", "Audit existing comments for injected CSS and remove any malicious payloads; consider applying a temporary block on new comments while remediation is underway."], "summary": {"action": "Immediate Patch", "impact": "Click\u2011jacking via CSS injection in comments"}, "threat_synthesis": {"affected_systems": "All installations of XWiki Platform running versions prior to 17.9.0, 17.4.6, or 16.10.13 are impacted. The issue originates in the comment rendering engine which does not sanitize CSS payloads. Administrators should verify the product version and upgrade if necessary, or disable the ability to embed CSS within comments if an upgrade is not immediately possible.", "description_and_impact": "XWiki Platform allows end\u2011users to add comments that are stored and rendered as part of the wiki page. An attacker can insert CSS rules into a comment, causing the entire page layout to shift and redirect users to a malicious target when they click on content. The vulnerability is a typical case of CSS injection (CWE\u20111021), leading to click\u2011jacking that can result in phishing, credential theft, or unintended navigation for any user who views the affected page.", "risk_and_exploitability": "The CVSS score of 5.3 indicates a moderate level of risk, while the EPSS value of less than 1% points to a low likelihood of widespread exploitation. The vulnerability does not appear in the CISA KEV catalog. Exploitation requires an attacker to post a malicious comment that targets a user who later views the page, which is a likely vector in environments where user comments are publicly accessible. Once triggered, the attack can mislead users into clicking on non\u2011existent links or deceptive navigation flows, compromising confidentiality of user intent and possibly integrity if additional payloads are used."}}}}, "created": "2026-02-13T21:29:25.189673+00:00", "updated": "2026-04-17T20:00:09.041857+00:00", "vendors": ["xwiki", "xwiki$PRODUCT$xwiki-platform"]}