CVE-2026-48910

MEDIUM 6.5

Apache JSPWiki: Markdown parser allows XSS injection in Markdown error processing

CVSS Score

6.5

EPSS Score

0.0%

EPSS Percentile

0th

A carefully crafted editing request could trigger an XSS vulnerability on Apache JSPWiki when parsing errors on the markdown renderer, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. This issue affects Apache JSPWiki: through 2.12.3. Users are recommended to upgrade to version 2.12.4, which fixes the issue.

CWE	CWE-80
Vendor	apache software foundation
Product	apache jspwiki
Published	Jul 30, 2026
Last Updated	Jul 30, 2026

Stay Ahead of the Next One

Get instant alerts for apache software foundation apache jspwiki

Be the first to know when new medium vulnerabilities affecting apache software foundation apache jspwiki are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Apache Software Foundation / Apache JSPWiki

0 ≤ 2.12.3

References

NVD ↗ CVE.org ↗ EPSS Data ↗

lists.apache.org: https://lists.apache.org/thread/yvbdjnocw5qq3xkbjs9h77ghlg0bsw2c openwall.com: http://www.openwall.com/lists/oss-security/2026/07/30/18

Credits

Justin Ng from Cyver Security Agency of Singapore / Inland Reveue Authority of Singapore