What is the CVSS score of CVE-2026-2861?

CVE-2026-2861 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of Foswiki are affected by CVE-2026-2861?

Organizations using Foswiki should be aware of moderate risk from CVE-2026-2861, a information exposure vulnerability rated CVSS 5.3. Sensitive information could be exposed to unauthorized parties.. A patch is available.

How to fix or mitigate CVE-2026-2861?

Within 30 days: Identify affected systems running Foswiki and apply vendor patches as part of regular patch cycle. Review data exposure and access controls.

Foswiki CVE-2026-2861

MEDIUM

Information Exposure (CWE-200)

2026-02-21 cna@vuldb.com

Information Disclosure Foswiki

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Patch released

Mar 16, 2026 - 16:16 nvd

Patch available

Analysis Generated

Mar 12, 2026 - 22:04 vuln.today

CVE Published

Feb 21, 2026 - 06:17 nvd

MEDIUM 5.3

DescriptionCVE.org

A vulnerability was detected in Foswiki up to 2.1.10. The affected element is an unknown function of the component Changes/Viewfile/Oops. The manipulation results in information disclosure. It is possible to launch the attack remotely. The exploit is now public and may be used. Upgrading to version 2.1.11 is sufficient to fix this issue. The patch is identified as 31aeecb58b64/d8ed86b10e46. Upgrading the affected component is recommended.

AnalysisAI

Information disclosure in Foswiki versions up to 2.1.10 allows unauthenticated remote attackers to access sensitive data through the Changes/Viewfile/Oops component. Public exploit code exists for this vulnerability. Upgrading to version 2.1.11 or later resolves the issue.

Technical ContextAI

Classified as CWE-200 (Information Exposure). Affects Foswiki. A vulnerability was detected in Foswiki up to 2.1.10. The affected element is an unknown function of the component Changes/Viewfile/Oops. The manipulation results in information disclosure. It is possible to launch the attack remotely. The exploit is now public and may be used. Upgrading to version 2.1.11 is sufficient to fix this issue. The patch is identified as 31aeecb58b64/d8ed86b10e46. Upgrading the affected component is recommended.