CVE-2026-48910
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
An XSS vulnerability in Apache JSPWiki allows an attacker to inject malicious JavaScript via a crafted editing request, exploiting parsing errors in the Markdown renderer. This could lead to session hijacking and theft of sensitive data.
Risk Assessment
The risk includes the possibility of executing scripts in the victim's browser, potentially leading to credential theft, session hijacking, or disclosure of other confidential information.
Recommendation
Upgrade Apache JSPWiki to version 2.12.4 immediately, which contains the fix for this vulnerability.
Other vulnerabilities in Apache JSPWiki
See all- CVE-2026-28812Critical
Apache JSPWiki up to version 2.12.3 lacks checks in UserManager, allowing impersonation. An attacker can escalate privileges.
- CVE-2026-28814High
Apache JSPWiki up to version 2.12.3 is vulnerable to arbitrary Wiki markup rendering due to lack of authentication. An attacker can obtain sensitive data stored in JSPWiki variables.
- CVE-2026-28813High
Apache JSPWiki up to version 2.12.3 is vulnerable to JSON Hijacking, which leads to CSRF vulnerabilities. An attacker can exploit this to perform unauthorized actions on behalf of a user.
- CVE-2026-28811High
Apache JSPWiki up to version 2.12.3 reveals unnecessary information in debug messages. This can lead to leakage of sensitive data.
Original NVD description (English source)
A carefully crafted editing request could trigger an XSS vulnerability on Apache JSPWiki when parsing errors on the markdown renderer, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. This issue affects Apache JSPWiki: through 2.12.3. Users are recommended to upgrade to version 2.12.4, which fixes the issue.