What is GHSA-72ww-4rcw-mc62?

GHSA-72ww-4rcw-mc62 is a security advisory published by GitHub Security Advisories with Medium severity. Apache JSPWiki Cross-Site Scripting (XSS) Vulnerability in the Image Plugin

Which CVE IDs does GHSA-72ww-4rcw-mc62 cover?

GHSA-72ww-4rcw-mc62 covers the following CVE IDs: CVE-2025-24854. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by GHSA-72ww-4rcw-mc62?

GHSA-72ww-4rcw-mc62 affects 1 product, including: maven/org.apache.jspwiki:jspwiki-main:\u003c 2.12.3.

GHSA-72ww-4rcw-mc62Medium

Apache JSPWiki Cross-Site Scripting (XSS) Vulnerability in the Image Plugin

Vendor

GitHub Security Advisories

Published

July 31, 2025

Last Modified

November 5, 2025

🔗 CVE IDs covered (1)

CVE-2025-24854 →

📋 Description

A carefully crafted request using the Image plugin could trigger an XSS vulnerability on Apache JSPWiki, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim.

Apache JSPWiki users should upgrade to 2.12.3 or later.

🎯 Affected products1

maven/org.apache.jspwiki:jspwiki-main:< 2.12.3

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2025-24854
https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2025-24854
http://www.openwall.com/lists/oss-security/2025/07/30/3
https://github.com/advisories/GHSA-72ww-4rcw-mc62