The XWiki Platform's xwiki-commons component suffers from a relative path traversal vulnerability (CWE-23) that permits unauthorized reading of configuration files such as xwiki.cfg. This occurs when the 'resource' parameter in the ssx and jsx endpoints is manipulated with leading slashes and relative path sequences (e.g., '/../..'), allowing traversal outside the intended directory. The vulnerability affects multiple versions before 16.10.17, 17.4.9, 17.10.3, and 18.1.0-rc-1. The issue has been patched in these versions, mitigating the risk.

Successful exploitation allows unauthenticated attackers to read sensitive configuration files, potentially exposing configuration details that could aid further attacks or information disclosure. The CVSS 4.0 score of 9.3 reflects critical severity with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability.

Upgrade xwiki-commons to version 16.10.17, 17.4.9, 17.10.3, or 18.1.0-rc-1 or later, where this path traversal vulnerability has been patched. Since the vendor advisory confirms these fixed versions, applying these official updates is the recommended remediation. Patch status is confirmed by the vendor advisory information embedded in the CVE description.