PT-2026-43465 · Xwiki · Xwiki

Published 2026-05-21 · Updated 2026-05-26 · CVE-2026-48047

Positive Technologies (AI Summary)

CVSS v4.0

5.9

Medium

Base vector

AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions XWiki versions prior to 16.10.17 XWiki versions prior to 17.4.9 XWiki versions prior to 17.10.3 XWiki versions prior to 18.0.0RC1

Description A path traversal issue allows an attacker to write arbitrary files, which could lead to overriding configuration files or changing the superadmin password. This requires the attacker to have admin access to at least one subwiki to install a malicious WebJar extension and to have published that extension in a configured extension repository. Path traversal is a technique used to access files and directories that are stored outside the web root folder.

Recommendations Update to version 16.10.17. Update to version 17.4.9. Update to version 17.10.3. Update to version 18.0.0RC1. Be cautious when granting script and admin rights to users.

Fix

Weakness Enumeration

CWE-24

Related Identifiers

CVE-2026-48047

GHSA-VGWR-23FQ-PR7G

Affected Products

Xwiki

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-48047 · Security Note
• https://osv.dev/vulnerability/GHSA-vgwr-23fq-pr7g · Vendor Advisory
• https://github.com/xwiki/xwiki-platform/commit/9f747fcd3200259a1de51957d3f5f6acc8e3816c · Note
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-vgwr-23fq-pr7g · Note
• https://github.com/xwiki/xwiki-platform · Note
• https://jira.xwiki.org/browse/XWIKI-23902 · Note