CVE-2026-40105 xwiki CVE debrief

Who should care

Defenders responsible for XWiki Platform instances, especially those with admin users, should assess exposure and prioritize patching or mitigation to prevent potential XSS attacks.

Why it matters

A reflected cross-site scripting (XSS) vulnerability in XWiki Platform allows an attacker to execute JavaScript code in a user's browser when they view the comparison between revisions of a page, potentially affecting the confidentiality, integrity, and availability of the entire XWiki instance if the current user is an admin.

• An attacker could execute JavaScript code in a user's browser when they view the comparison between revisions of a page.
• If the current user is an admin, this could affect the confidentiality, integrity, and availability of the entire XWiki instance.
• Defenders should verify the affected versions and patch or mitigate the vulnerability to prevent potential XSS attacks.
• The vulnerability requires verification of user input and output to prevent JavaScript code injection.

Technical summary

The XWiki Platform is vulnerable to a reflected cross-site scripting (XSS) attack in the comparison view between revisions of a page. This allows an attacker to execute JavaScript code in a user's browser. The vulnerability affects versions 10.4-rc-1 through 16.10.15, 17.0.0-rc-1 through 17.4.7, and 17.5.0-rc-1 through 17.10.0. The vulnerability requires verification of user input and output to prevent JavaScript code injection. Defenders should prioritize patching or mitigating this vulnerability, especially for admin users, to prevent potential XSS attacks. The vulnerability can be patched manually by updating the templates/changesdoc.vm file in the deployed WAR.

Defensive priority

Defenders should prioritize patching or mitigating this vulnerability, especially for admin users, to prevent potential XSS attacks.

Recommended defensive actions

• Apply the patch manually to templates/changesdoc.vm in the deployed WAR if immediate update is not possible.
• Update to a version outside the affected ranges (10.4-rc-1 through 16.10.15, 17.0.0-rc-1 through 17.4.7, and 17.5.0-rc-1 through 17.10.0).
• Restrict access to the comparison view between revisions of a page to trusted users.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Review compensating controls for exposed systems while remediation is scheduled and verified.

Evidence notes

The CVE record and NVD vulnerability detail provide information on the affected versions and potential impact of the vulnerability. The vulnerability affects XWiki Platform versions 10.4-rc-1 through 16.10.15, 17.0.0-rc-1 through 17.4.7, and 17.5.0-rc-1 through 17.10.0. Defenders should verify the affected versions and patch or mitigate the vulnerability to prevent potential XSS attacks. The vulnerability requires verification of user input and output to prevent JavaScript code injection. There is no information on known or unknown 3

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.