The XWiki Platform WebJars API contains a path traversal vulnerability (CWE-24) that permits an attacker who has admin privileges on at least a subwiki and can install a malicious WebJar extension to write arbitrary files on the server. Exploitation requires the attacker to publish a malicious extension in a configured extension repository. This vulnerability affects versions prior to 16.10.17, 17.4.9, and 17.10.3 and has been fixed in these and later versions. The vulnerability could allow severe consequences such as overwriting configuration files and resetting the superadmin password.

An attacker with admin access to a subwiki and the ability to install malicious extensions can write arbitrary files, potentially leading to configuration file overwrites and superadmin password changes. This elevates the risk of unauthorized control over the XWiki instance. However, exploitation requires significant pre-existing privileges and setup, limiting the risk to privileged users.

This vulnerability has been patched in XWiki versions 16.10.17, 17.4.9, 17.10.3, and later. Users should upgrade to one of these fixed versions. No other workarounds are known, so it is recommended to carefully control which users have script and admin rights to prevent installation of malicious extensions.