Path Traversal Vulnerability in XWiki Platform
CVE-2026-23734
9.3CRITICAL
What is CVE-2026-23734?
A path traversal vulnerability exists in the XWiki Platform that allows unauthorized access to sensitive configuration files. Exploited through specially crafted URLs that manipulate the resource parameter in the ssx and jsx endpoints, this flaw could lead to unintended exposure of internal configuration settings. This vulnerability affects all versions prior to the patched releases: 18.1.0-rc-1, 17.10.3, 17.4.9, and 16.10.17, posing a serious risk to deployed applications.
Affected Version(s)
xwiki-commons < 16.10.17 < 16.10.17
xwiki-commons >= 17.0.0-rc-1, < 17.4.9 < 17.0.0-rc-1, 17.4.9
xwiki-commons >= 17.5.0, < 17.10.3 < 17.5.0, 17.10.3