CVE-2026-23734: XWiki Platform: Path traversal via resources parameter in ssx and jsx endpoints when using leading slash
Impact
It's possible to get access and read configuration files by using URLs such as http://localhost:8080/bin/ssx/Main/WebHome?resource=/../../WEB-INF/xwiki.cfg&minify=false.
This can apparently be reproduced on Tomcat instances.
Patches
This has been patched in 18.0.0-rc-1, 17.10.3, 17.4.9, 16.10.17.
Workarounds
There is no known workaround, other than upgrading XWiki.
References
https://jira.xwiki.org/browse/XCOMMONS-3547 https://github.com/xwiki/xwiki-commons/commit/a979cafd89f6a9c9c0b9ab19744d672df64429bf
For more information
If you have any questions or comments about this advisory: Open an issue in Jira XWiki.org Email us at Security Mailing List
Attribution
The vulnerability was reported by Michał Kołek.
Other sources
XWiki Platform is a generic wiki platform. Versions prior to 18.1.0-rc-1, 17.10.3, 17.4.9, and 16.10.17 allow access to read configuration files by using URLs such as http://localhost:8080/bin/ssx/Main/WebHome?resource=/../../WEB-INF/xwiki.cfg&minify=false, leading to Path Traversal. The vulnerability is can be exploited via resources parameter the ssx and jsx endpoints by using leading slashes. This issue has been patched in 18.1.0-rc-1, 17.10.3, 17.4.9, 16.10.17.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.xwiki.commons:xwiki-commons-classloader-apito a version that resolves this vulnerability.Fixed in 18.1.0-rc-1 - Upgrade
Upgrade
maven/org.xwiki.commons:xwiki-commons-classloader-apito a version that resolves this vulnerability.Fixed in 17.10.3 - Upgrade
Upgrade
maven/org.xwiki.commons:xwiki-commons-classloader-apito a version that resolves this vulnerability.Fixed in 17.4.9 - Upgrade
Upgrade
maven/org.xwiki.commons:xwiki-commons-classloader-apito a version that resolves this vulnerability.Fixed in 16.10.17 - Upgrade
Upgrade
XWiki Platformto a version that resolves this vulnerability.Fixed in 18.1.0-rc-1 - Upgrade
Upgrade
XWiki Platformto a version that resolves this vulnerability.Fixed in 17.10.3 - Upgrade
Upgrade
XWiki Platformto a version that resolves this vulnerability.Fixed in 17.4.9 - Upgrade
Upgrade
XWiki Platformto a version that resolves this vulnerability.Fixed in 16.10.17
Event History
Frequently Asked Questions
What is the severity of CVE-2026-23734?
CVE-2026-23734 has a high severity due to the possibility of unauthorized access to sensitive configuration files.
How do I fix CVE-2026-23734?
To fix CVE-2026-23734, upgrade to XWiki Platform versions 18.1.0-rc-1, 17.10.3, 17.4.9, or 16.10.17.
What are the affected versions for CVE-2026-23734?
The affected versions for CVE-2026-23734 are prior to 18.1.0-rc-1, 17.10.3, 17.4.9, and 16.10.17.
What type of vulnerability is CVE-2026-23734?
CVE-2026-23734 is a path traversal vulnerability that allows reading of configuration files.
Can CVE-2026-23734 be exploited remotely?
Yes, CVE-2026-23734 can be exploited remotely by accessing vulnerable ssx and jsx endpoints.