CVE-2024-37900: XWiki Platform vulnerable to Cross-site Scripting through attachment filename in uploader

CVE-2024-37900. EPSS 0.15804 (percentile 0.96876), scored 24-Oct-2026. Fixed version: c6cc6af0637c7e8f8be850fe4af66576934f8a53. Fixed version: 5583e277218ab5de9930d969082a19ed0db4e472. Fixed version: 5408ff53a61f0775cc5314a7ccde04c61c84caba. Fixed version: 1bcc6e962dc5701ae6f9745a209a5c0c97461128. Fixed version: 447f13c6b159cf0671b65c6be8f790cf046d7ada. Fixed version: 150468c1e2cd64a2ad85b5053e9487943d3b9b1f. Fixed version: 3c6f5cf138d8095f63631e554ba448e4b780e162. Fixed version: 6cdd69d31d6bf3caa7f40ec55eb317e4e528ad28. Fixed version: 8b8a2d80529b9a9c038014c1eb6c2adc08069dfd.

Affected technology

XWiki Platform vulnerable to Cross-site Scripting · through attachment filename in uploader
Vendor not specified by the source

Component: Not specified by the source

Attack conditions (OSV, CVSS 3.1): Network (remote) · Low privileges required · User interaction required

What an attacker can do

OSV’s CVSS 3.1 assessment rates confidentiality and integrity impact as high; availability impact as none. The description does not specify what an attacker can achieve beyond these rated impacts.

Published 25-Oct-2026 01:00 UTC

CCR priority: 4.0 /100 (P5)
CVSS 3.1: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N · OSV.dev
EPSS: 0.15804 · percentile 0.96876 · 2026-10-24
KEV: no

Provenance

OSV.dev · Source record · observed 2026-10-24 16:38:25.544256+00:00 UTC

Stable permalink: https://cybercodered.org/item/cve-cve-2024-37900.html