CVE-2026-48910: Apache JSPWiki: Markdown parser allows XSS injection in Markdown error processing
A carefully crafted editing request could trigger an XSS vulnerability on Apache JSPWiki when parsing errors on the markdown renderer, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim.
This issue affects Apache JSPWiki: through 2.12.3.
Users are recommended to upgrade to version 2.12.4, which fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache JSPWikito a version that resolves this vulnerability.Fixed in 2.12.4
Event History
Frequently Asked Questions
What is the severity of CVE-2026-48910?
CVE-2026-48910 has a risk score of 36, indicating it poses a significant security risk.
How do I fix CVE-2026-48910?
To mitigate CVE-2026-48910, ensure that you upgrade to the latest version of Apache JSPWiki that addresses this vulnerability.
What type of vulnerability is CVE-2026-48910?
CVE-2026-48910 is identified as a cross-site scripting (XSS) vulnerability.
Who is affected by CVE-2026-48910?
CVE-2026-48910 affects users of Apache JSPWiki who utilize the markdown renderer.
What can attackers achieve using CVE-2026-48910?
Attackers exploiting CVE-2026-48910 can execute JavaScript in victims' browsers and potentially steal sensitive information.