Executive brief
Apache JSPWiki, a popular open-source wiki engine, is vulnerable to a security flaw in its page editing system. An attacker can send a specially crafted request that causes the wiki's markdown editor to execute malicious code in a user's web browser. This could allow an attacker to steal sensitive information or perform actions on behalf of the victim.
Technical details
A Cross-Site Scripting (XSS) vulnerability exists in Apache JSPWiki versions through 2.12.3. The flaw is located within the markdown renderer's error handling logic. When the renderer encounters specific parsing errors triggered by a crafted editing request, it fails to properly neutralize script-related HTML tags (CWE-80). An attacker can exploit this by tricking a user into viewing or processing a malicious request, leading to the execution of arbitrary JavaScript in the context of the victim's session. This can result in the theft of sensitive session information or unauthorized actions. The issue is resolved in version 2.12.4.
Affected products
- Apache Software Foundation JSPWiki up to 2.12.3
Timeline
- 2026-07-30: advisory: Initial disclosure by Apache Software Foundation
- 2026-07-30: patched: Version 2.12.4 released to address the vulnerability