CVE-2026-40105

Name: CVE-2026-40105
Creator: NVD / NIST
Published: 2026-04-15T04:17:48.137+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

MEDIUMCVSS 6.5/10EPSS 0.55%

Last modified Jun 17, 2026

CVE-2026-40105 is a medium-severity vulnerability rated 6.5/10 on the CVSS scale. XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Versions 10.4-rc-1, through 16.10.15, 17.0.0-rc-1, through 17.4.7 and 17.5.0-rc-1 through 17.10.0 contain a reflected cross-site scripting vulnerability (XSS) in the comparison view between revisions of a page allows executing JavaScript code in the user's browser. EPSS estimates a 0.55% chance of exploitation in the next 30 days.

Description

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Versions 10.4-rc-1, through 16.10.15, 17.0.0-rc-1, through 17.4.7 and 17.5.0-rc-1 through 17.10.0 contain a reflected cross-site scripting vulnerability (XSS) in the comparison view between revisions of a page allows executing JavaScript code in the user's browser. If the current user is an admin, this can not only affect the current user but also the confidentiality, integrity and availability of the whole XWiki instance. If developers are unable to update immediately, they can apply the patch manually to templates/changesdoc.vm in the deployed WAR.

Metrics

CVSS 3.1

6.1/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CVSS 4.0

6.5/10

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS Probability

0.55%

41.7th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-80

Affected Software

Vendor	Product	Versions
Xwiki	Xwiki	>= 10.4, < 16.10.16
Xwiki	Xwiki	>= 17.0.0, < 17.4.8
Xwiki	Xwiki	>= 17.5.0, < 17.10.1

References

https://github.com/xwiki/xwiki-platform/commit/3c8a2ec985641367015c2db937574fcd360c788cPatch
https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-w4fj-87j5-f25cVendor Advisory
https://jira.xwiki.org/browse/XWIKI-23472Vendor Advisory

Timeline

Published: Apr 15, 2026
Last Modified: Jun 17, 2026
Status: Analyzed

Frequently Asked Questions

What is CVE-2026-40105?

How severe is CVE-2026-40105?

CVE-2026-40105 has a CVSS score of 6.5/10 (MEDIUM severity). The EPSS model estimates a 0.55% probability of exploitation in the next 30 days.

How do I fix CVE-2026-40105?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2026-40105?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST