CVE-2026-34151 Details
Description
XWiki Platform is a generic wiki platform. Prior to 17.10.5 and 18.2.0, the /skin/ action in com.xpn.xwiki.web.SkinAction can resolve double-encoded parent-directory segments outside the intended skin or web-application resource prefix when Jetty 12 or later decodes the request path. The affected lookup is replaced with Environment.getResourceAsStream(String, String), which constrains a resource to its expected prefix. An unauthenticated remote attacker can use the vulnerable behavior to read arbitrary resources permitted to the Jetty process, including WEB-INF/xwiki.cfg and, depending on deployment depth and operating-system permissions, host files. Tomcat and Jetty versions before 12 do not appear affected. This issue is fixed in versions 17.10.5 and 18.2.0.
A path traversal vulnerability has been identified in XWiki Platform versions prior to 17.10.5 and 18.2.0. When Jetty 12 or later decodes the request path, the vulnerability allows for double-encoded parent-directory segments to be resolved outside the intended resource prefix. This misconfiguration can be exploited by an unauthenticated remote attacker to access arbitrary resources within the Jetty process, such as WEB-INF/xwiki.cfg and potentially other host files, depending on the deployment depth and operating system permissions.
Users can upgrade to XWiki Platform versions 17.10.5 or 18.2.0, where this vulnerability has been patched. Instructions for upgrading can be found in the XWiki documentation.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 14, 2026CISA-ADP
Assessed Sep 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/xwiki/xwiki-commons/pull/1675 | [email protected] | Issue TrackingVendor |
| https://github.com/xwiki/xwiki-platform/commit/79eba8655f3a96021a8e7ad07956e48d20a82383 | [email protected] | Source CodeVendor |
| https://github.com/xwiki/xwiki-platform/commit/f7b33704083d3b4e45d1b9fc1e2cc33c66855f85 | [email protected] | Source CodeVendor |
| https://github.com/xwiki/xwiki-platform/releases/tag/xwiki-platform-17.10.5 | [email protected] | Release NotesVendor |
| https://github.com/xwiki/xwiki-platform/releases/tag/xwiki-platform-18.2.0 | [email protected] | Release NotesVendor |
| https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-qj4x-9g63-25g6 | [email protected] | AdvisoryRemedyVendor |
| https://jira.xwiki.org/browse/XCOMMONS-3594 | [email protected] | Issue TrackingVendor |
| https://jira.xwiki.org/browse/XWIKI-24075 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-24 | Path Traversal: '../filedir' | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| XWiki Platform | <= 17.10.4 (semver) ~18.2 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 14, 2026 | CVE Modified | CISA-ADP |
| Sep 14, 2026 | New CVE Received | [email protected] |