See how foswiki compares to other vendors in security performance
Multiple cross-site scripting (XSS) vulnerabilities in JumpBox before 1.1.2 for Foswiki Wiki System allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
A vulnerability was detected in Foswiki up to 2.1.10. The affected element is an unknown function of the component Changes/Viewfile/Oops. The manipulation results in information disclosure. It is possible to launch the attack remotely. The exploit is now public and may be used. Upgrading to version 2.1.11 is sufficient to fix this issue. The patch is identified as 31aeecb58b64/d8ed86b10e46. Upgrading the affected component is recommended.
Hi Alexander,
thanks for the clarification. I'll do better next time.
Regards, Michael.
On Montag, 16. März 2026 03:27:32 Mitteleuropäische Normalzeit Solar Designer wrote: Hello Michael,
Thank you for bringing this to oss-security.
We require actual detail in here, not just "read more at", and the above web pages don't tell much about the CVE. There's some actual detail in:
https://foswiki.org/Support/SecurityAlertCVE20262861
which I'll partially quote below: Alexander -- -- Board Member Foswiki Association e.V. -- https://foswiki.org/Main/MichaelDaum
Hello Michael,
Thank you for bringing this to oss-security.
On Sun, Mar 15, 2026 at 03:06:24PM +0100, Michael Daum wrote: Foswiki 2.1.11 is available to downloaded now. This release came earlier than expected due to the severe security issues found in previous versions, as detailed in CVE-2026-2861. Read more at https://foswiki.org/Blog/Foswiki2111IsReleased and https://foswiki.org/System/ReleaseNotes02x01#FoswikiRelease2.1.11Details
Donwload from https://foswiki.org/Download/FoswikiRelease02x01x11 We require actual detail in here, not just "read more at", and the above web pages don't tell much about the CVE. There's some actual detail in:
https://foswiki.org/Support/SecurityAlertCVE20262861
which I'll partially quote below: Security Alert: Information disclosure vulnerability in viewfile, oops, preview and changes endpoints 15 March 2026 - 14:30 | Version 4 | Michael Daum
An anonymous user can craft an HTTP url to oops, preview, changes and viewfile endpoint to disclose access protected information.
Attack Vectors
An anonymous user can craft an HTTP url to the oops, changes or preview endpoint and disclose protected information. For example https://mysite.com/bin/oops/Web/SecretTopicWithFormData?template=view will disclose any data stored a the given page. Given a topic without view rights an unauthorized user can test for the existence of attachments using viewfile. The endpoint's order of checking acccess rights and checking file existence is performend in the wrong order.
Impact
Information disclosure of private data.
Details
The changes script does not check access view rights on the topic it was loaded on. This is a security problem for any template loading additional data at this point. This endpoint has been deprecated for a long time and does not serve any particular purpose anymore.
The viewfile's order of checking acccess rights and checking file existence is performend in the wrong order. It foremost needs to check access and only then do anything else.
The oops endpoint accepts an arbitrary template url parameter such as template=view and thus functions as a normal view endpoint, however without performing any access control checks. Similarly preview can be exploited.
Countermeasures
To minimize the attack surface endpoints changes, preview and search are removed from the switch board configuration. See hotfix in Item15600: changes and preview scripts do not check view access rights, Item15601: viewfile can be used to test for existing files even without view rights on the topic and Item15602: oops script can be used to display data even without view access rights.
Upgrade to the latest patched production Foswiki Release 2.1.11 is highly encourage.
Authors and Credits
Found by: Jan Seebens (Deutsche Telekom Technik GmbH) and Michael Daum Consulting
Action Plan with Timeline
2026-01-12 - Disclosure of issue to foswiki security mailing list 2026-01-12 - Developer verifies issue 2026-01-12 - Hotfix foswiki.org website 2026-01-17 - Developer fixes code 2026-02-20 - Security team creates advisory with hotfix
2026-02-?? - Release Manager builds patch release 2026-02-?? - Send alert to foswiki-announce and foswiki-discuss mailing lists 2026-02-?? - Publish advisory in Support web and update all related topics 2026-02-?? - Reference to public advisory on Download page and Known Issues 2026-02-?? - Issue a public security advisory (vuln () secunia com, cert () cert org, bugs () securitytracker com bugtraq () securityfocus com full-disclosure () lists grok org uk), https://openwall.com/lists/oss-security (name) Alexander
Dear all,
Foswiki 2.1.11 is available to downloaded now. This release came earlier than expected due to the severe security issues found in previous versions, as detailed in CVE-2026-2861. Read more at https://foswiki.org/Blog/Foswiki2111IsReleased and https://foswiki.org/System/ReleaseNotes02x01#FoswikiRelease2.1.11Details
Donwload from https://foswiki.org/Download/FoswikiRelease02x01x11
Regards, Michael.
-- -- Board Member Foswiki Association e.V. -- https://foswiki.org/Main/MichaelDaum
Insufficient parameter validation in the Foswiki::Sandbox component of Foswiki v2.1.7 and below allows attackers to perform a directory traversal via supplying a crafted web request.
An issue in the SpreadSheetPlugin component of Foswiki v2.1.7 and below allows attackers to execute a directory traversal.
Multiple cross-site scripting (XSS) vulnerabilities in UI/Register.pm in Foswiki before 1.1.5 allow remote authenticated users with CHANGE privileges to inject arbitrary web script or HTML via the (1) text, (2) FirstName, (3) LastName, (4) OrganisationName, (5) OrganisationUrl, (6) Profession, (7) Country, (8) State, (9) Address, (10) Location, (11) Telephone, (12) VoIP, (13) InstantMessagingIM, (14) Email, (15) HomePage, or (16) Comment parameter. NOTE: some of these details are obtained from third party information.
Cross-site request forgery (CSRF) vulnerability in Foswiki before 1.0.5 allows remote attackers to hijack the authentication of arbitrary users for requests that modify pages, change permissions, or change group memberships, as demonstrated by a URL for a (1) save or (2) view script in the SRC attribute of an IMG element, a related issue to CVE-2009-1339.
UI/Manage.pm in Foswiki 1.1.0 and 1.1.1 allows remote authenticated users to gain privileges by modifying the GROUP and ALLOWTOPICCHANGE preferences in the topic preferences for Main.AdminGroup.
The localization functionality in TWiki before 5.1.3, and Foswiki 1.0.x through 1.0.10 and 1.1.x through 1.1.6, allows remote attackers to cause a denial of service (memory consumption) via a large integer in a %MAKETEXT% macro.
Foswiki before 1.1.8 contains a code injection vulnerability in the MAKETEXT macro.
Dear all,
we've got a new release out. Update is highly recommended as it fixes 9 critical security related bugs, i.e.
CVE-2023-33756: SpreadSheetPlugin's EVAL feature exposes information about paths and files on the server CVE-2023-24698: Local file inclusion vulnerability in viewfile
Read more about it at https://blog.foswiki.org/Blog/Foswiki218IsReleased
Regards, Michael.
-- -- Michael Daum Consulting -- Knowledge Management Service & Solutions -- https://www.michaeldaumconsulting.com -- Tel: +49 (0)40 21 99 27 51