xwiki: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 2

• Medium 6.9
  CVE-2026-40104

  XWiki's REST APIs can list all pages/spaces, leading to unavailability

  XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Versions 1.8-rc-1, 17.0.0-rc-1 and 17.5.0-rc-1 and prior include a resource exhaustion vulnerability in REST API endpoints such as /xwiki/rest/wikis/xwiki…

  xwiki org.xwiki.platform:xwiki-platform-legacy-oldcore org.xwiki.platform:xwiki-platform-oldcore org.xwiki.platform:xwiki-platform-oldcore Maven
  Apr 15, 2026
• Medium 6.5
  CVE-2026-40105 Scanner template

  XWiki has Reflected Cross-Site Scripting (XSS) in its page history compare functionality

  XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Versions 10.4-rc-1, through 16.10.15, 17.0.0-rc-1, through 17.4.7 and 17.5.0-rc-1 through 17.10.0 contain a reflected cross-site scripting vulnerability (…

  xwiki xwiki-platform org.xwiki.platform:xwiki-platform-web-templates Maven
  Apr 15, 2026

Revision history

1. 2026-04-14 #2

   Referenz(en) aufgenommen: EUVD-2026-22817, EUVD-2026-22819

2. 2026-04-13 #1

   Initiale Fassung

References

• GitHub Security Advisory GHSA-mrqg-xmgm-rc5g vom 2026-04-13
  https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-mrqg-xmgm-rc5g
• GitHub Security Advisory GHSA-w4fj-87j5-f25c vom 2026-04-13
  https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-w4fj-87j5-f25c