CVE-2026-40104: xwiki — Katalog CVE

csirt@kutim:~/threat-intel/cve/CVE-2026-40104

CVSS 8.2 · High EPSS 0,70%

Kerentanan Allocation of Resources Without Limits or Throttling pada xwiki. Skor CVSS 3.1 8.2 (High) menurut CISA ADP.

Deskripsi (NVD)

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Versions 1.8-rc-1, 17.0.0-rc-1 and 17.5.0-rc-1 and prior include a resource exhaustion vulnerability in REST API endpoints such as /xwiki/rest/wikis/xwiki/spaces/AnnotationCode/pages/AnnotationConfig/objects/AnnotationCode.AnnotationConfig/0/properties, which list all available pages as part of the metadata for database list properties without applying query limits. On large wikis, this can exhaust available server resources. This issue has been patched in versions 16.10.16, 17.4.8 and 17.10.1.

Rincian

Terbit di NVD: 15 April 2026
Terakhir diubah: 17 Juni 2026
Status NVD: Analyzed
CVSS 3.1: 8.2 (High), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-770: Allocation of Resources Without Limits or Throttling
EPSS (30 hari): 0,70% peluang dieksploitasi; lebih tinggi dari 51,8% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
xwiki	xwiki	Versi 1.8 hingga sebelum 16.10.16
xwiki	xwiki	Versi 17.0.0 hingga sebelum 17.4.8
xwiki	xwiki	Versi 17.5.0 hingga sebelum 17.10.1

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-mrqg-xmgm-rc5g advisory vendor
https://jira.xwiki.org/browse/XWIKI-23550 issue tracking · advisory vendor
https://github.com/xwiki/xwiki-platform/commit/47b568c4753a6e682b14be1ca581bdd3b25d45a7 patch

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.