CVE-2026-48910

MediumCVSS 6.5/10Last modified Oct 23, 2026

Description

A carefully crafted editing request could trigger an XSS vulnerability on Apache JSPWiki when parsing errors on the markdown renderer, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim.

This issue affects Apache JSPWiki: through 2.12.3.

Users are recommended to upgrade to version 2.12.4, which fixes the issue.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-80

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache JSPWiki	<= 2.12.3

References

https://lists.apache.org/thread/yvbdjnocw5qq3xkbjs9h77ghlg0bsw2cMailing List, Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/07/30/18Mailing List, Third Party Advisory

Timeline

Published: Jul 30, 2026
Last modified: Oct 23, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-489117.5Insufficient Verification of Data Authenticity vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.1. A missing CVE-2026-489126.5Improper Input Validation vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.1. A missing ownership check in t CVE-2026-489137.3Use After Free vulnerability in Apache HTTP Server module mod_http2 when file handles are already exhausted. This issue affects Apache HTTP CVE-2026-489146.7A flaw was found in QEMU's virtio-blk device. The issue arises because the device does not properly validate the size of input descriptors b CVE-2026-489166.6Jenkins LDAP Plugin 807.v7d7de30930cf and earlier follows LDAP referrals.CVE-2026-489176.6Jenkins LDAP Plugin 807.v7d7de30930cf and earlier deserializes data from LDAP referrals without validation.CVE-2026-489186.6Jenkins Active Directory Plugin 2.41 and earlier follows LDAP referrals by default.CVE-2026-489196.6Jenkins Active Directory Plugin 2.41 and earlier deserializes data from LDAP referrals without validation.CVE-2026-48928.4A heap-based out-of-bounds write vulnerability in the DHCPv6 implementation of dnsmasq allows local attackers to execute arbitrary code with CVE-2026-489208.8Jenkins Email Extension Plugin 1933.v45cec755423f and earlier allows inlining images as `base64` in email content by setting the `data-inlin CVE-2026-489217.5Jenkins Pipeline: Groovy Libraries Plugin 797.v90ea_a_9b_e45a_0 and earlier does not prohibit symbolic links in shared libraries, allowing a CVE-2026-489227.5Jenkins Credentials Binding Plugin 720.v3f6decef43ea_ and earlier does not properly sanitize file names for file and zip file credentials, a