EUVD-2026-51181
GHSA-9c4x-gmwm-cj68
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Network-reachable without credentials or user interaction; only confidentiality is impacted as the flaw enables read-only variable disclosure with no write or availability effect.
Primary rating from Vendor (CNA).
CVSS VectorVendor
Lifecycle Timeline
6Description PRE-NVD
Articles & Coverage 1
AnalysisAI
Unauthenticated Wiki Markup rendering in Apache JSPWiki up to 2.12.3 exposes sensitive data stored in internal JSPWiki variables to remote attackers. The flaw stems from a missing authentication check (CWE-306) on the markup rendering endpoint, allowing any network-reachable attacker to trigger rendering and extract variable contents without credentials. No public exploit has been identified and EPSS sits at a low 0.21% (12th percentile), but the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms trivially easy remote unauthenticated exploitation against default deployments. Vendor patches are available.
Technical ContextAI
Apache JSPWiki is a Java Server Pages-based wiki engine that processes a custom wiki markup language. When rendering markup, the engine resolves internal JSPWiki variables - which can include configuration values, user data, or other sensitive runtime state - and outputs them in the rendered page. CWE-306 (Missing Authentication for Critical Function) identifies the root cause: the markup rendering pathway fails to enforce authentication, meaning the variable-resolution and rendering logic executes for any requester regardless of session state. The EUVD CPE data confirms affected versions span from 0 through 2.12.3 inclusive.
RemediationAI
Upgrade to Apache JSPWiki 2.12.4 or 3.0.0, both confirmed as fixing this issue per the vendor advisory at https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2026-28814 and the oss-security disclosure at https://seclists.org/oss-sec/2026/q3/342. If an immediate upgrade is not feasible, compensating controls include placing JSPWiki behind an authenticating reverse proxy (e.g., nginx with require valid-user) to enforce authentication at the perimeter before requests reach the markup renderer - note this may break intended anonymous read access for public wikis. Alternatively, restricting network access to the JSPWiki instance via firewall rules to trusted IP ranges reduces exposure without affecting application behavior. Review JSPWiki variable definitions to minimize sensitive data stored in engine-accessible variables as a defense-in-depth measure.
Privilege escalation via user impersonation affects Apache JSPWiki through version 2.12.3, where the UserManager compone
Remote attackers may delete arbitrary files in a system hosting a JSPWiki instance, versions up to 2.11.0.M8, by using a
Cross-site request forgery via JSON Hijacking affects Apache JSPWiki through version 2.12.3, letting a remote attacker w
A carefully crafted invocation on the Image plugin could trigger an CSRF vulnerability on Apache JSPWiki before 2.11.3,
Apache JSPWiki user preferences form is vulnerable to CSRF attacks, which can lead to account takeover. Rated high sever
Apache JSPWiki versions up to and including 2.12.3 expose sensitive application internals through debug messages returne
A specially crafted url could be used to access files under the ROOT directory of the application on Apache JSPWiki 2.9.
Cross-site scripting in Apache JSPWiki's Markdown renderer error-handling path allows attackers with page-editing access
A carefully crafted request on UserPreferences.jsp could trigger an CSRF vulnerability on Apache JSPWiki before 2.11.3,
XSS in Upload page in Apache JSPWiki 2.12.1 and priors allows the attacker to execute javascript in the victim's browser
A carefully crafted request on WeblogPlugin could trigger an XSS vulnerability on Apache JSPWiki, which could allow the
A carefully crafted request on AJAXPreview.jsp could trigger an XSS vulnerability on Apache JSPWiki, which could allow t
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today