CVE-2026-23734: XWiki Platform: Path traversal via resources parameter in ssx and jsx endpoints when using leading slash

Published May 20, 2026
·
Updated

XWiki Platform is a generic wiki platform. Versions prior to 18.1.0-rc-1, 17.10.3, 17.4.9, and 16.10.17 allow access to read configuration files by using URLs such as http://localhost:8080/bin/ssx/Main/WebHome?resource=/../../WEB-INF/xwiki.cfg&minify=false, leading to Path Traversal. The vulnerability is can be exploited via resources parameter the ssx and jsx endpoints by using leading slashes. This issue has been patched in 18.1.0-rc-1, 17.10.3, 17.4.9, 16.10.17.

Affected Software

1 affected component
XWiki XWiki Platform<18.1.0-rc-1, <17.10.3, <17.4.9, <16.10.17

Event History

May 20, 2026
CVE Published
via MITRE·06:39 PM
Data Sourced
via MITRE·06:39 PM
DescriptionWeakness
Data Sourced
via NVD·08:16 PM
DescriptionSeverityWeakness
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of CVE-2026-23734?

CVE-2026-23734 has a high severity due to the possibility of unauthorized access to sensitive configuration files.

2

How do I fix CVE-2026-23734?

To fix CVE-2026-23734, upgrade to XWiki Platform versions 18.1.0-rc-1, 17.10.3, 17.4.9, or 16.10.17.

3

What are the affected versions for CVE-2026-23734?

The affected versions for CVE-2026-23734 are prior to 18.1.0-rc-1, 17.10.3, 17.4.9, and 16.10.17.

4

What type of vulnerability is CVE-2026-23734?

CVE-2026-23734 is a path traversal vulnerability that allows reading of configuration files.

5

Can CVE-2026-23734 be exploited remotely?

Yes, CVE-2026-23734 can be exploited remotely by accessing vulnerable ssx and jsx endpoints.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203