CVE-2026-34151: CWE-24: Path Traversal: '../filedir' in xwiki xwiki-platform
XWiki Platform is a generic wiki platform. Prior to 17.10.5 and 18.2.0, the /skin/ action in com.xpn.xwiki.web.SkinAction can resolve double-encoded parent-directory segments outside the intended skin or web-application resource prefix when Jetty 12 or later decodes the request path. The affected lookup is replaced with Environment.getResourceAsStream(String, String), which constrains a resource to its expected prefix. An unauthenticated remote attacker can use the vulnerable behavior to read arbitrary resources permitted to the Jetty process, including WEB-INF/xwiki.cfg and, depending on deployment depth and operating-system permissions, host files. Tomcat and Jetty versions before 12 do not appear affected. This issue is fixed in versions 17.10.5 and 18.2.0.
AI Analysis
Technical Summary
The vulnerability (CVE-2026-34151) affects XWiki Platform's /skin/ action in com.xpn.xwiki.web.SkinAction, where double-encoded '../' sequences can be resolved outside the intended resource prefix when running on Jetty 12 or later. This allows an unauthenticated attacker to read arbitrary files accessible to the Jetty process, including sensitive configuration files like WEB-INF/xwiki.cfg. The flaw arises because the resource lookup did not properly constrain resource access, which was later fixed by replacing the lookup with Environment.getResourceAsStream(String, String) to enforce resource prefix constraints. Tomcat and Jetty versions before 12 are not affected.
Potential Impact
An unauthenticated remote attacker can exploit this vulnerability to read arbitrary files accessible by the Jetty process, potentially exposing sensitive configuration files and host system files depending on deployment and OS permissions. This can lead to information disclosure and may aid further attacks.
Mitigation Recommendations
Upgrade XWiki Platform to version 17.10.5 or later, or 18.2.0 or later, where the vulnerability is fixed. No other mitigations are indicated. Patch status is confirmed fixed in these versions.
CVE-2026-34151: CWE-24: Path Traversal: '../filedir' in xwiki xwiki-platform
Description
XWiki Platform is a generic wiki platform. Prior to 17.10.5 and 18.2.0, the /skin/ action in com.xpn.xwiki.web.SkinAction can resolve double-encoded parent-directory segments outside the intended skin or web-application resource prefix when Jetty 12 or later decodes the request path. The affected lookup is replaced with Environment.getResourceAsStream(String, String), which constrains a resource to its expected prefix. An unauthenticated remote attacker can use the vulnerable behavior to read arbitrary resources permitted to the Jetty process, including WEB-INF/xwiki.cfg and, depending on deployment depth and operating-system permissions, host files. Tomcat and Jetty versions before 12 do not appear affected. This issue is fixed in versions 17.10.5 and 18.2.0.
CVSS v4.0
Score 8.2high
Affected software
xwiki
xwiki-platform
pkg:maven/org.xwiki/xwiki-platformRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability (CVE-2026-34151) affects XWiki Platform's /skin/ action in com.xpn.xwiki.web.SkinAction, where double-encoded '../' sequences can be resolved outside the intended resource prefix when running on Jetty 12 or later. This allows an unauthenticated attacker to read arbitrary files accessible to the Jetty process, including sensitive configuration files like WEB-INF/xwiki.cfg. The flaw arises because the resource lookup did not properly constrain resource access, which was later fixed by replacing the lookup with Environment.getResourceAsStream(String, String) to enforce resource prefix constraints. Tomcat and Jetty versions before 12 are not affected.
Potential Impact
An unauthenticated remote attacker can exploit this vulnerability to read arbitrary files accessible by the Jetty process, potentially exposing sensitive configuration files and host system files depending on deployment and OS permissions. This can lead to information disclosure and may aid further attacks.
Mitigation Recommendations
Upgrade XWiki Platform to version 17.10.5 or later, or 18.2.0 or later, where the vulnerability is fixed. No other mitigations are indicated. Patch status is confirmed fixed in these versions.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-03-25T20:12:04.196Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6aa8300055bf5e2cf5600a65
Added to database: 09/14/2026, 17:33:52 UTC
Last enriched: 09/14/2026, 17:46:47 UTC
Last updated: 09/15/2026, 03:12:02 UTC
Views: 10
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.