The XWiki Platform WebJars API contains a path traversal vulnerability (CWE-24) that allows an attacker with admin access to a subwiki to write arbitrary files by installing a malicious WebJar extension. This could lead to severe consequences such as overriding configuration files and resetting the superadmin password. Exploitation requires that the attacker already has elevated privileges and can publish a malicious extension in a repository configured on the instance. The vulnerability affects versions prior to 16.10.17, 17.4.9, and 17.10.3 and has been patched in these versions and later releases.

An attacker with admin privileges on at least a subwiki can exploit this vulnerability to write arbitrary files on the server. This could result in overriding critical configuration files and changing the superadmin password, potentially leading to full system compromise. However, exploitation requires significant prior access and setup, limiting the risk to already privileged users.

This vulnerability has been patched in XWiki versions 16.10.17, 17.4.9, 17.10.3, and 18.0.0RC1. Users should upgrade to one of these versions or later. No other workarounds are known, so it is important to restrict admin and script rights carefully to trusted users only.