CVE-2026-48910CWE-80

CVE-2026-48910

Medium · published July 30, 2026

CVSS v3.1
6.5
EPSS
1%
Percentile
45.8
In the wild
Unconfirmed
What it is

A carefully crafted editing request could trigger an XSS vulnerability

on Apache JSPWiki when parsing errors on the markdown renderer, which

could allow the attacker to execute javascript in the victim's browser

and get some sensitive information about the victim.

This issue affects Apache JSPWiki: through 2.12.3.

Users are recommended to upgrade to version 2.12.4, which fixes the issue.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00560 · 45.8th percentile
Weakness
CWE-80 · Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Published
2026-07-30T20:17Z
Affected products (1)
ProductVersionsFixed in
apache/jspwiki< 2.12.42.12.4
References (2)
https://lists.apache.org/thread/yvbdjnocw5qq3xkbjs9h77ghlg0bsw2c · [email protected]http://www.openwall.com/lists/oss-security/2026/07/30/18 · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 30 JUL 15:56Z
    Apache JSPWiki: Markdown parser allows XSS injection in Markdown error processing
    cvelistv5