XWiki vulnerable to a reflected XSS via xredirect parameter in DeleteApplication
Impact
A reflected XSS vulnerability in XWiki allows an attacker to send a victim to a URL with a deletion confirmation message on which the attacker-supplied script is executed when the victim clicks the "No" button. When the victim has admin or programming right, this allows the attacker to execute basically arbitrary actions on the XWiki installation including remote code execution.
Patches
This vulnerability has been patched in XWiki 16.10.10, 17.4.2 and 17.5.0 by using the affected URL parameter only in the intended context.
Workarounds
The patch can be manually applied to the templates that are present in the WAR. A restart of XWiki is needed for the changes to be applied.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Java / Kotlin (Maven) | org.xwiki.platform:xwiki-platform-flamingo-skin-resources | >= 6.2-milestone-1, < 16.10.10, >= 17.0.0-rc-1, < 17.4.2 | 16.10.10, 17.4.2 |
| Java / Kotlin (Maven) | org.xwiki.platform:xwiki-platform-web-templates | >= 6.2-milestone-1, < 16.10.10, >= 17.0.0-rc-1, < 17.4.2 | 16.10.10, 17.4.2 |
References
- CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H- Weakness (CWE)
CWE-79, CWE-80- Platform
- Java / Kotlin (Maven)
- Package
org.xwiki.platform:xwiki-platform-flamingo-skin-resources, org.xwiki.platform:xwiki-platform-web-templates- Disclosed
- 10.12.2025
- Updated
- 11.10.2026 12:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-7vpr-jm38-wr7w - CC BY 4.0
Vulnerability history: org.xwiki.platform:xwiki-platform-flamingo-skin-resources
All published vulnerabilities of this package (Java / Kotlin (Maven)), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 6
- First → latest
- 04.2023 12.2025
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- Critical 4
- High 1
- Medium 1
Disclosures per year
- 2023: 5
- 2024: 0
- 2025: 1
- 2026: 0
-
XWiki vulnerable to a reflected XSS via xredirect parameter in DeleteApplication this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.