Overview
Apache JSPWiki is a Java wiki engine. When wiki markup creates a header link, the link target reaches the rendered page without proper escaping. The JSPWiki team found the same gap in its Markdown parser while fixing the first report.
An attacker saves crafted markup to a page, and the script runs for anyone who views it. Apache JSPWiki 2.12.3 fixes both parsers.
Affected products
- Apache JSPWiki before 2.12.3
Disclosure timeline
- 25 Jul 2025
- Apache tags JSPWiki 2.12.3 with the fix
- 30 Jul 2025
- Apache announces the fix on oss-security
- 31 Jul 2025
- CVE-2025-24853 published