CVE-2026-48910

Awaiting Analysis Awaiting Analysis - Queue

Cross-Site Scripting in Apache JSPWiki Markdown Renderer

Publication date: 2026-07-30

Last updated on: 2026-07-30

Assigner: Apache Software Foundation

Description

A carefully crafted editing request could trigger an XSS vulnerability on Apache JSPWiki when parsing errors on the markdown renderer, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. This issue affects Apache JSPWiki: through 2.12.3. Users are recommended to upgrade to version 2.12.4, which fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-30

Last Modified

2026-07-30

Generated

2026-07-31

AI Q&A

2026-07-31

EPSS Evaluated

N/A

NVD

CVE-2026-48910

EUVD

EUVD-2026-51183

Affected Vendors & Products

Vendor	Product	Version / Range
apache	jspwiki	to 2.12.4 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-80	The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages.

Attack-Flow Graph

Executive Summary

This vulnerability is a Cross-Site Scripting (XSS) issue in Apache JSPWiki. A crafted editing request could exploit a parsing error in the markdown renderer to execute JavaScript in a victim's browser. This allows attackers to steal sensitive information from the victim.

Detection Guidance

This vulnerability involves an XSS issue in Apache JSPWiki's markdown renderer. To detect it, check if your Apache JSPWiki version is 2.12.3 or earlier. No specific commands are provided, but inspecting server logs for suspicious markdown parsing errors or unusual JavaScript execution may help identify exploitation attempts.

Impact Analysis

If exploited, this vulnerability could allow attackers to run malicious scripts in your browser when using Apache JSPWiki. This may lead to theft of session cookies, sensitive data, or unauthorized actions on your behalf.

Compliance Impact

This XSS vulnerability could expose sensitive user data, potentially violating GDPR (data protection) and HIPAA (health information privacy) by enabling unauthorized access or disclosure of personal information.

Mitigation Strategies

Upgrade Apache JSPWiki to version 2.12.4 or later immediately to patch the vulnerability. If upgrading is not possible, consider disabling the markdown renderer or applying input validation filters to block malicious markdown content.

Hi! I’m here to help you understand CVE-2026-48910. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70