CVE-2026-26000: XWiki Platform XSS Vulnerability

CVE-2026-26000 Overview

CVE-2026-26000 is a CSS Injection vulnerability in XWiki Platform, a generic wiki platform offering runtime services for applications built on top of it. This vulnerability allows attackers to inject malicious CSS through the comments feature, which can transform the entire wiki page into a clickable link area that redirects users to malicious pages. This type of attack is classified under CWE-1021 (Improper Restriction of Rendered UI Layers or Frames), commonly associated with clickjacking attacks.

Critical Impact
Unauthenticated attackers can exploit comment functionality to inject CSS that transforms the entire wiki interface into a deceptive link, potentially leading users to phishing sites or malicious content without their knowledge.

Affected Products

XWiki Platform versions prior to 17.9.0
XWiki Platform versions prior to 17.4.6
XWiki Platform versions prior to 16.10.13

Discovery Timeline

2026-02-12 - CVE CVE-2026-26000 published to NVD
2026-02-12 - Last updated in NVD database

Technical Details for CVE-2026-26000

Vulnerability Analysis

The vulnerability exists in XWiki Platform's comment handling mechanism, where user-supplied input is not properly sanitized before being rendered in the page context. This allows an attacker to inject arbitrary CSS code through comment content. The injected CSS can manipulate the visual presentation of the wiki page, creating invisible overlay elements or transforming existing page elements into clickable areas that redirect to attacker-controlled URLs.

The attack requires user interaction, as victims must click somewhere on the compromised page to be redirected. However, since the malicious CSS can make the entire page area function as a single hyperlink, normal user browsing behavior becomes the trigger mechanism.

Root Cause

The root cause is insufficient input sanitization in the comment rendering pipeline. XWiki Platform fails to properly escape or filter CSS properties and values within user-submitted comments, allowing style declarations to be injected and rendered in the page context. This lack of Content Security Policy enforcement for inline styles enables the attack to succeed.

Attack Vector

The attack is network-based and can be executed by unauthenticated users who have permission to post comments on wiki pages. The attacker crafts a malicious comment containing CSS code designed to overlay the page with an invisible link element. When any authenticated user visits the compromised page and clicks anywhere on it, they are redirected to the attacker's malicious destination.

The attack flow typically involves:

Attacker identifies a publicly accessible wiki page that accepts comments
Attacker submits a comment containing CSS injection payload
The CSS creates a full-page overlay element with a malicious link
Victims visiting the page and clicking anywhere are redirected to the malicious URL

Detection Methods for CVE-2026-26000

Indicators of Compromise

Unusual CSS content within wiki comments containing positioning properties like position: fixed or position: absolute
Comments containing HTML or CSS that reference external URLs
User reports of unexpected redirections when interacting with wiki pages
Audit logs showing comment submissions with suspicious style-related content

Detection Strategies

Implement Content Security Policy (CSP) headers to restrict inline styles and detect policy violations
Monitor web application firewall logs for CSS injection patterns in POST requests to comment endpoints
Review comment content for CSS keywords such as position, z-index, opacity, and external URL references
Deploy client-side integrity monitoring to detect unexpected DOM modifications

Monitoring Recommendations

Enable verbose logging on the XWiki Platform to capture all comment submissions
Configure alerting for comments containing potential CSS injection patterns
Monitor for anomalous traffic patterns indicating users being redirected away from the wiki
Implement user behavior analytics to detect clickjacking-style attacks

How to Mitigate CVE-2026-26000

Immediate Actions Required

Upgrade XWiki Platform to version 17.9.0, 17.4.6, or 16.10.13 depending on your current release branch
Review existing comments for potentially malicious CSS content and remove suspicious entries
Implement Content Security Policy headers to restrict inline style execution
Consider temporarily disabling the comment functionality until patches are applied

Patch Information

The XWiki development team has addressed this vulnerability in the following releases:

Version 17.9.0 - Full fix included
Version 17.4.6 - Backported fix for 17.4.x branch
Version 16.10.13 - Backported fix for 16.10.x branch

For detailed patch information and release notes, refer to the GitHub Release 17.4.6 and the GitHub Security Advisory GHSA-74rh-c5rh-88vg.

Workarounds

Implement strict Content Security Policy headers that block inline styles: style-src 'self'
Restrict comment posting permissions to authenticated and trusted users only
Deploy a web application firewall rule to filter CSS-related content in comment submissions
Enable comment moderation to manually review all comments before publication

bash

# Example CSP header configuration for Apache
Header set Content-Security-Policy "default-src 'self'; style-src 'self'; script-src 'self'"