https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T21:30:31.996211+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2026-02020 bdu:2026-02020 2026-10-04T21:30:32.078902+00:00 bdu:2026-02020 https://cve.radiocsirt.org/vuln/euvd-2026-268243 EUVD-2026-268243 2026-10-04T21:30:32.078940+00:00 EUVD-2026-268243 https://cve.radiocsirt.org/vuln/fkie_cve-2026-26000 fkie_cve-2026-26000 2026-10-04T21:30:32.078956+00:00

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Prior to 17.9.0, 17.4.6, and 16.10.13, it's possible using comments to inject CSS that would transform the full wiki in a link area leading to a malicious page. This vulnerability is fixed in 17.9.0, 17.4.6, and 16.10.13.

 https://cve.radiocsirt.org/vuln/ghsa-74rh-c5rh-88vg GHSA-74rh-c5rh-88vg — XWiki vulnerable to click-jacking through CSS injection in comments 2026-10-04T21:30:32.078988+00:00

Affected: Maven: org.xwiki.platform:xwiki-platform-web

### Impact

It's possible using comments to inject CSS that would transform the full wiki in a link area leading to a malicious page. All versions of XWiki are impacted by this kind of attack.

### Patches

The problem has been patched not by preventing injecting CSS in comments, which is currently a feature of XWiki, but by requiring confirmation from users when driving them to untrusted domains after clicking on a link, thus preventing any click-jacking attack. This security measure has been put in place in XWiki 17.9.0, 17.4.6, 16.10.13.

### Workarounds

There's no out-of-the-box workaround, but it should be possible to partly reuse [the javascript code provided for the security measure](https://github.com/xwiki/xwiki-platform/blob/xwiki-platform-17.9.0/xwiki-platform-core/xwiki-platform-web/xwiki-platform-web-war/src/main/webapp/resources/uicomponents/link/link-protection.js) in a JSX object inside the wiki, to request the same kind of confirmation.

### References * JIRA ticket: https://jira.xwiki.org/browse/XWIKI-23433 * Documentation of the new security measure: https://www.xwiki.org/xwiki/bin/view/ReleaseNotes/Data/XWiki/17.9.0RC1/Entry006/ * Commit for the security fix: https://github.com/xwiki/xwiki-platform/commit/29cb81f3a5387cf822d7e7534bdd63903275f86b

### For more information

If you have any questions or comments about this advisory: * Open an issue in [Jira XWiki.org](https://jira.xwiki.org/) * Email us at [Security Mailing List](mailto:security@xw…

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0412 WID-SEC-W-2026-0412 — xwiki: Schwachstelle ermöglicht Darstellen falscher Informationen 2026-10-04T21:30:32.079036+00:00

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in xwiki ausnutzen, um falsche Informationen darzustellen.