Overview
The JSPWiki Image plugin takes parameters from the page markup and writes them into the generated HTML without neutralizing them.
An attacker crafts a plugin invocation that carries script, and it runs in the browser of anyone who loads the page. Apache JSPWiki 2.12.3 fixes the issue.
Affected products
- Apache JSPWiki before 2.12.3
Disclosure timeline
- 25 Jul 2025
- Apache tags JSPWiki 2.12.3 with the fix
- 31 Jul 2025
- Apache advisory and CVE-2025-24854 published