Is there a public PoC exploit available for CVE-2026-40105?

Yes, a public proof-of-concept exploit is available for CVE-2026-40105. Prioritise patching immediately. EPSS: 0.0%.

Is there a patch available for CVE-2026-40105?

Yes, a patch is available for CVE-2026-40105. Update the affected software to the latest version immediately.

CVE-2026-40105

Q: What is the CVSS score of CVE-2026-40105?

CVE-2026-40105 has a CVSS 4.0 base score of 6.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-22819 MEDIUM

Basic XSS (CWE-80)

2026-04-14 https://github.com/xwiki/xwiki-platform

GHSA-w4fj-87j5-f25c

XSS

6.5

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

6.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

PoC Detected

Apr 23, 2026 - 13:52 vuln.today

Public exploit code

Analysis Generated

Apr 15, 2026 - 01:12 vuln.today

EUVD ID Assigned

Apr 14, 2026 - 22:46 euvd

EUVD-2026-22819

Analysis Generated

Apr 14, 2026 - 22:46 vuln.today

Patch released

Apr 14, 2026 - 22:46 nvd

Patch available

CVE Published

Apr 14, 2026 - 22:33 nvd

MEDIUM 6.5

DescriptionGitHub Advisory

Impact

A reflected cross-site scripting vulnerability (XSS) in the compare view between revisions of a page allows executing JavaScript code in the user's browser. If the current user is an admin, this can not only affect the current user but also the confidentiality, integrity and availability of the whole XWiki instance.

Patches

The problem has been patched by properly escaping the URL parameters.

Workarounds

The patch can be applied manually to templates/changesdoc.vm in the deployed WAR.

Attribution

XWiki thanks Mike Cole @mikecole-mg for discovering and reporting this vulnerability.

AnalysisAI

Reflected cross-site scripting (XSS) in XWiki's compare view allows unauthenticated attackers to execute arbitrary JavaScript in a user's browser by injecting malicious code through unescaped URL parameters in the page revision comparison feature. When the victim is an administrator, successful exploitation compromises the confidentiality, integrity, and availability of the entire XWiki instance. Vendor-released patch is available; no public exploit code or active exploitation has been confirmed at time of analysis.

Technical ContextAI

The vulnerability exists in XWiki Platform's changesdoc.vm template file, which handles the display of differences between page revisions. The root cause is improper output encoding of URL parameters in the compare view (CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page). The affected component is the xwiki-platform-web-templates Maven package, which provides the Velocity template files used for rendering revision comparison interfaces. When user-controlled URL parameters are reflected directly into the HTML response without proper escaping, an attacker can break out of the HTML context and inject JavaScript payloads that execute with the privileges of the authenticated user viewing the comparison.

RemediationAI

Apply the vendor patch by updating org.xwiki.platform:xwiki-platform-web-templates to a version released after the fix commit (3c8a2ec985641367015c2db937574fcd360c788c). Consult the XWiki GitHub Security Advisory at https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-w4fj-87j5-f25c for the specific patched version number and release date. As an immediate workaround for unpatched deployments, manually apply the patch to the templates/changesdoc.vm file in the deployed WAR archive by replacing the vulnerable template with the corrected version from the GitHub commit. After applying any patch or workaround, test the compare view functionality with both normal and admin accounts to confirm XSS injection is blocked and revision comparison continues to work correctly.