PT-2026-42215 · Xwiki · Xwiki Platform

Majkelstick · Published 2026-05-20 · Updated 2026-05-26 · CVE-2026-23734

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions XWiki Platform versions prior to 18.1.0-rc-1 XWiki Platform versions prior to 17.10.3 XWiki Platform versions prior to 17.4.9 XWiki Platform versions prior to 16.10.17

Description Path Traversal allows unauthorized access to read configuration files. This occurs via the resource parameter in the 'ssx' and 'jsx' endpoints by using leading slashes, enabling an attacker to access sensitive files such as xwiki.cfg.

Recommendations Update to version 18.1.0-rc-1. Update to version 17.10.3. Update to version 17.4.9. Update to version 16.10.17.

Fix

Relative Path Traversal

Weakness Enumeration

CWE-23

Related Identifiers

CVE-2026-23734

GHSA-XQ3R-2QV5-VQQM

Affected Products

Xwiki Platform

References · 10

• https://osv.dev/vulnerability/GHSA-xq3r-2qv5-vqqm · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-23734 · Security Note
• https://github.com/xwiki/xwiki-commons/security/advisories/GHSA-xq3r-2qv5-vqqm · Note
• https://github.com/xwiki/xwiki-commons · Note
• https://github.com/xwiki/xwiki-commons/commit/a979cafd89f6a9c9c0b9ab19744d672df64429bf · Note
• https://twitter.com/UpwindMDR/status/2059325421062168793 · Twitter Post
• https://i.redd.it/3cmmwoqb5p2h1.png · Reddit Post
• https://t.me/CVEtracker/54411 · Telegram Post
• https://twitter.com/Horizon3ai/status/2057827443411423718 · Twitter Post
• https://jira.xwiki.org/browse/XCOMMONS-3547 · Note