Medium
Security advisory
The Image Import function in XWiki through 10.7 has XSS.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2018-16277
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 05:25 UTC · Revision 1
Source evidence
The Image Import function in XWiki through 10.7 has XSS.
osv:CVE-2018-16277
Complete source record
{
"id": "5266cddc7ca559b4c3ec1f09c24ec69b7d9057e8408684c16a695a7d1226fae8",
"url": "https://osv.dev/vulnerability/CVE-2018-16277",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2018-16277",
"summary": "The Image Import function in XWiki through 10.7 has XSS.",
"evidence": "osv:CVE-2018-16277",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2018-16277",
"aliases": [
"CVE-2018-16277",
"GHSA-6mvr-cq72-f66v"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/xwiki/xwiki-commons",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"last_affected": "e98106a0e02d3d90b95498df82917d6334fbb115"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"last_affected": "10.7"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"xwiki-commons-10.7",
"xwiki-commons-10.7-rc-1",
"xwiki-commons-8.3-milestone-2",
"xwiki-commons-8.3-milestone-1",
"xwiki-commons-8.2-milestone-2",
"xwiki-commons-8.2-milestone-1",
"xwiki-commons-8.1-milestone-2",
"xwiki-commons-8.1-milestone-1",
"xwiki-commons-8.0-milestone-2",
"xwiki-commons-8.0-milestone-1"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-16277.json"
}
},
{
"ranges": [
{
"repo": "https://github.com/xwiki/xwiki-platform",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"last_affected": "931efef88e1888985620b6f7c835e2186de8771f"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"last_affected": "10.7"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"xwiki-platform-10.7",
"xwiki-platform-10.7-rc-1",
"xwiki-platform-9.9-rc-2",
"xwiki-platform-8.3-milestone-1",
"xwiki-platform-8.2-milestone-2",
"xwiki-platform-8.2-milestone-1",
"xwiki-platform-8.1-milestone-2",
"xwiki-platform-8.1-milestone-1",
"xwiki-platform-8.0-milestone-2",
"xwiki-platform-8.0-milestone-1",
"xwiki-platform-7.4-milestone-2",
"xwiki-platform-7.4-milestone-1",
"xwiki-platform-7.3-milestone-2"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-16277.json"
}
}
],
"modified": "2026-10-24T10:30:28.667164544Z",
"provider": "osv",
"references": [
"https://mksec.tk/index.php/2018/09/27/cve-2018-16277-xss-in-xwiki/"
],
"provider_metadata": {}
},
"related_cves": [
{
"value": "CVE-2018-16277",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 432113,
"published_at": "2018-09-28T00:29:01.477+00:00"
}