CVE-2026-48047

Received Received - Intake

Path Traversal in XWiki Platform WebJars API

Publication date: 2026-08-07

Last updated on: 2026-08-07

Assigner: GitHub, Inc.

Description

XWiki Platform WebJars API is a package for XWiki, a generic wiki platform. Starting with version 9.6-rc-1 and prior to versions 16.10.17, 17.4.9, and 17.10.3, a potential path traversal vulnerability allow an attacker who manages to get a malicious WebJar extension installed on the wiki to write arbitrary files. While the consequences could be severe like overriding configuration files and setting the superadmin password, the attack first requires that the attacker already has admin access to at least a subwiki to be able to install a malicious extension. Further, the attacker needs to publish a malicious extension in an extension repository that is configured in the instance. This vulnerability has been patched in XWiki 16.10.17, 17.4.9, 17.10.3, and 18.0.0RC1. XWiki is not aware of any workarounds except for being careful whom developers grant script and admin rights to.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-07

Last Modified

2026-08-07

Generated

2026-08-08

AI Q&A

2026-08-08

EPSS Evaluated

N/A

NVD

CVE-2026-48047

Affected Vendors & Products

Vendor	Product	Version / Range
xwiki	xwiki_platform_webjars_api	to 16.10.17 (exc)
xwiki	xwiki_platform_webjars_api	16.10.17
xwiki	xwiki_platform_webjars_api	17.4.9
xwiki	xwiki_platform_webjars_api	17.10.3
xwiki	xwiki_platform_webjars_api	18.0.0rc1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-24	The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize "../" sequences that can resolve to a location that is outside of that directory.

Attack-Flow Graph

Executive Summary

This vulnerability is a path traversal issue in XWiki Platform WebJars API affecting versions 9.6-rc-1 through 16.10.16, 17.4.8, and 17.10.2. It allows an attacker with admin access to a subwiki to install a malicious WebJar extension and write arbitrary files by exploiting path traversal. This could lead to severe consequences like overriding configuration files or setting the superadmin password.

Detection Guidance

Detecting this vulnerability requires checking for malicious WebJar extensions installed on the XWiki instance. Review installed extensions in the XWiki administration panel and verify their sources. Check for unexpected file modifications or new files in the XWiki data directory.

Impact Analysis

If you are an XWiki administrator, an attacker who gains admin access to any subwiki could exploit this to write arbitrary files on your system. This may allow them to modify configurations, escalate privileges, or disrupt services. The attack requires prior admin access, so limiting admin rights reduces risk.

Compliance Impact

This vulnerability could lead to unauthorized file modifications, potentially exposing sensitive data or violating integrity requirements in GDPR or HIPAA. Unauthorized changes to configurations or user data may result in non-compliance with data protection and security standards.

Mitigation Strategies

Upgrade XWiki to versions 16.10.17, 17.4.9, 17.10.3, or 18.0.0RC1 or later. Remove any untrusted or suspicious WebJar extensions. Restrict admin and script rights to trusted users only.

Hi! I’m here to help you understand CVE-2026-48047. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70