Listen to this Post
How the CVE Works:
The vulnerability exists within the error message templating system (templates/logging_macros.vm). When XWiki generates an error page (e.g., for a missing page or permission denial), it reflects a user-provided parameter from the HTTP request directly into the HTML output without proper sanitization. An attacker crafts a malicious URL containing a JavaScript payload within this parameter. If an authenticated victim is tricked into clicking this link, the payload is executed in their browser context within the XWiki domain. This allows the attacker to perform any actions the victim is authorized to do, such as making unauthorized wiki modifications, stealing session cookies, or, if the victim has admin rights, compromising the entire XWiki instance.
DailyCVE Form:
Platform: XWiki
Version: 7.0M2 to 16.10.11
Vulnerability: Reflected XSS
Severity: Moderate
Date: 2026-01-23
Prediction: Patched 2026-01-23
What Undercode Say:
Analytics:
curl -v "https://target-xwiki.org/xwiki/bin/view/NonExistentPage?xpage=something&payload=<script>alert(document.domain)</script>" grep -n "xredirect" xwiki-platform-web-templates/src/main/resources/templates/logging_macros.vm
Vulnerable line (conceptual):
$request.getParameter('xredirect') Output not escaped
How Exploit:
Crafted malicious URL.
Victim clicks link.
JavaScript executes as victim.
Protection from this CVE:
Apply provided patches.
Manually patch template.
Sanitize user input.
Impact:
Session hijacking.
Admin rights escalation.
Full system compromise.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
