Path Traversal Vulnerability in XWiki Platform's WebJars API
CVE-2026-48047
What is CVE-2026-48047?
A path traversal vulnerability has been identified in XWiki Platform's WebJars API, allowing an attacker with admin access to a subwiki to install a malicious WebJar extension. This could enable unauthorized file writing, potentially resulting in the overwrite of critical configuration files or administrative credentials. The vulnerability is present in specific versions of XWiki, where the attacker can exploit carefully configured extension repositories. Although patched in later versions, administrators must still manage script permissions and access rights diligently to mitigate risks.
Affected Version(s)
xwiki-platform >= 9.6-rc-1, < 16.10.17 < 9.6-rc-1, 16.10.17
xwiki-platform >= 17.0.0-rc-1, < 17.4.9 < 17.0.0-rc-1, 17.4.9
xwiki-platform >= 17.5.0-rc-1, < 17.10.3 < 17.5.0-rc-1, 17.10.3