XWiki Platform CVE-2026-48048
HIGH
GHSA-rh28-mqj4-8x59
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
2DescriptionNVD
Impact
XWiki discovered that the patch for GHSA-5cf8-vrr8-8hjm was insufficient and with slightly modified parameters to the LiveTableResults, it is still possible to discover password hashes one bit at a time, so with 768 requests, the full password salt and hash can be retrieved of a user.
Patches
The check for password (and email properties) has been adjusted in XWiki 18.0.0RC1, 17.10.13, 17.4.9 and 16.10.17.
Workarounds
The patch can be applied manually to the wiki page XWiki.LiveTableResultsMacros.
Resources
- https://jira.xwiki.org/browse/XWIKI-23875
- https://github.com/xwiki/xwiki-platform/commit/c4442716b02ffcdaa9d5e703b1db6203e36456fa
AnalysisAI
Information disclosure in XWiki Platform's LiveTableResults macro allows unauthenticated remote attackers to reconstruct user password hashes and salts one bit at a time by sending approximately 768 crafted requests with manipulated class-per-property parameters. This is a bypass of the prior fix for GHSA-5cf8-vrr8-8hjm, which failed to account for an alternate parameter path. …
Sign in for full analysis, threat intelligence, and remediation guidance.
RemediationAI
24 hours: Identify all XWiki Platform instances and document current versions in your environment. 7 days: Obtain and apply available vendor security patch for CVE-2026-48048 per XWiki security advisory. …
Sign in for detailed remediation steps.
Share
External POC / Exploit Code
Leaving vuln.today