EUVD-2026-51183
GHSA-g956-w8r6-2m72
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Network-accessible wiki requires edit-level privileges (PR:L); victim must render the error output (UI:R); XSS crosses from server to browser scope (S:C); impact limited to browser-side info disclosure and script injection (C:L/I:L), no availability impact.
Primary rating from Vendor (CNA).
CVSS VectorVendor
Lifecycle Timeline
3Description PRE-NVD
Articles & Coverage 1
AnalysisAI
Cross-site scripting in Apache JSPWiki's Markdown renderer error-handling path allows attackers with page-editing access to inject JavaScript that executes in victims' browsers, enabling session data theft and sensitive information exfiltration. All Apache JSPWiki releases through 2.12.3 are affected; the Apache Software Foundation has confirmed version 2.12.4 as the fix. No public exploit code has been identified at time of analysis and this CVE has no CISA KEV listing, but the edit-then-victim-view pattern is a well-understood XSS delivery model that requires minimal technical sophistication once editing access is available.
Technical ContextAI
Apache JSPWiki is a Java-based wiki engine that supports Markdown as an alternative rendering syntax. The vulnerability exists specifically in the error-handling code path of the Markdown renderer: when the parser encounters a specially crafted construct designed to induce a parsing failure, the resulting error output is emitted to the browser without sufficient HTML encoding, creating an XSS sink. No formal CWE was assigned in the advisory, but the root-cause class is CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-site Scripting). No CPE string was provided in the source data; the affected software is Apache JSPWiki through version 2.12.3 as stated by The Apache Software Foundation.
RemediationAI
Upgrade Apache JSPWiki to version 2.12.4 or later as directed by the Apache Software Foundation advisory at https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2026-48910. No official workarounds were specified. As a compensating control prior to patching, administrators may consider disabling Markdown rendering in favor of JSPWiki's native markup syntax if the deployment supports that configuration; this removes the vulnerable code path entirely but requires editors to switch syntax. Alternatively, restricting page-editing permissions to a minimal trusted set of users substantially reduces the attacker population without eliminating the vulnerability. Deploying a strict Content Security Policy that blocks inline script execution and restricts script-src to known origins will limit the impact of any XSS payload that does fire, though CSP is a defense-in-depth control and not a remediation for the underlying flaw.
Privilege escalation via user impersonation affects Apache JSPWiki through version 2.12.3, where the UserManager compone
Remote attackers may delete arbitrary files in a system hosting a JSPWiki instance, versions up to 2.11.0.M8, by using a
Cross-site request forgery via JSON Hijacking affects Apache JSPWiki through version 2.12.3, letting a remote attacker w
A carefully crafted invocation on the Image plugin could trigger an CSRF vulnerability on Apache JSPWiki before 2.11.3,
Apache JSPWiki user preferences form is vulnerable to CSRF attacks, which can lead to account takeover. Rated high sever
Unauthenticated Wiki Markup rendering in Apache JSPWiki up to 2.12.3 exposes sensitive data stored in internal JSPWiki v
Apache JSPWiki versions up to and including 2.12.3 expose sensitive application internals through debug messages returne
A specially crafted url could be used to access files under the ROOT directory of the application on Apache JSPWiki 2.9.
A carefully crafted request on UserPreferences.jsp could trigger an CSRF vulnerability on Apache JSPWiki before 2.11.3,
XSS in Upload page in Apache JSPWiki 2.12.1 and priors allows the attacker to execute javascript in the victim's browser
A carefully crafted request on WeblogPlugin could trigger an XSS vulnerability on Apache JSPWiki, which could allow the
A carefully crafted request on AJAXPreview.jsp could trigger an XSS vulnerability on Apache JSPWiki, which could allow t
Same weakness CWE-80 – Basic XSS
View allShare
External POC / Exploit Code
Leaving vuln.today