[CVE-2025-24854] Cross-Site Scripting (XSS) in JSPWiki Image plugin#

Severity
Medium

Vendor
The Apache Software Foundation

Versions Affected
Apache JSPWiki up to 2.12.2

Description
A carefully crafted request using the Image plugin could trigger an XSS vulnerability on Apache JSPWiki, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim.

Mitigation
Apache JSPWiki users should upgrade to 2.12.3 or later.

Credit
The issue was separately discovered by both XBOW (https://github.com/xbow-security, https://xbow.com) and Hamed Kohi <0x.hamy.1ATgmailDOTcom>