CVE-2026-23734: XWiki Platform: Path traversal via resources parameter in ssx and jsx endpoints when using leading slash
XWiki Platform is a generic wiki platform. Versions prior to 18.1.0-rc-1, 17.10.3, 17.4.9, and 16.10.17 allow access to read configuration files by using URLs such as http://localhost:8080/bin/ssx/Main/WebHome?resource=/../../WEB-INF/xwiki.cfg&minify=false, leading to Path Traversal. The vulnerability is can be exploited via resources parameter the ssx and jsx endpoints by using leading slashes. This issue has been patched in 18.1.0-rc-1, 17.10.3, 17.4.9, 16.10.17.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-23734?
CVE-2026-23734 has a high severity due to the possibility of unauthorized access to sensitive configuration files.
How do I fix CVE-2026-23734?
To fix CVE-2026-23734, upgrade to XWiki Platform versions 18.1.0-rc-1, 17.10.3, 17.4.9, or 16.10.17.
What are the affected versions for CVE-2026-23734?
The affected versions for CVE-2026-23734 are prior to 18.1.0-rc-1, 17.10.3, 17.4.9, and 16.10.17.
What type of vulnerability is CVE-2026-23734?
CVE-2026-23734 is a path traversal vulnerability that allows reading of configuration files.
Can CVE-2026-23734 be exploited remotely?
Yes, CVE-2026-23734 can be exploited remotely by accessing vulnerable ssx and jsx endpoints.