CVE-2026-34151
Received Received - Intake

Path Traversal in XWiki Platform

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: GitHub, Inc.

Description
XWiki Platform is a generic wiki platform. Prior to 17.10.5 and 18.2.0, the /skin/ action in com.xpn.xwiki.web.SkinAction can resolve double-encoded parent-directory segments outside the intended skin or web-application resource prefix when Jetty 12 or later decodes the request path. The affected lookup is replaced with Environment.getResourceAsStream(String, String), which constrains a resource to its expected prefix. An unauthenticated remote attacker can use the vulnerable behavior to read arbitrary resources permitted to the Jetty process, including WEB-INF/xwiki.cfg and, depending on deployment depth and operating-system permissions, host files. Tomcat and Jetty versions before 12 do not appear affected. This issue is fixed in versions 17.10.5 and 18.2.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-14
Last Modified
2026-09-14
Generated
2026-09-14
AI Q&A
2026-09-14
EPSS Evaluated
N/A
NVD
CVE-2026-34151
EUVD
EUVD-2026-77676

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
xwiki xwiki_platform 17.10.5
xwiki xwiki_platform 18.2.0
xwiki xwiki_platform to 17.10.5|end_excluding=18.2.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-24 The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize "../" sequences that can resolve to a location that is outside of that directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-34151 is a path traversal vulnerability in XWiki Platform affecting versions before 17.10.5 and 18.2.0. The issue occurs via the /skin/ action endpoint when using Jetty 12 or later. Attackers can craft URLs with double-encoded parent-directory segments to bypass path restrictions and access arbitrary files on the server, including sensitive files like WEB-INF/xwiki.cfg or system files like /etc/passwd.

Detection Guidance

To detect this vulnerability, check if your XWiki instance is running versions before 17.10.5 or 18.2.0. Test for path traversal attempts by sending crafted URLs like /xwiki/bin/skin/..%252f/..%252fWEB-INF/xwiki.cfg to the /skin/ endpoint. Monitor server logs for unusual file access patterns or errors indicating unauthorized resource access.

Impact Analysis

This vulnerability allows unauthenticated remote attackers to read arbitrary files accessible to the Jetty process. This includes sensitive configuration files (e.g., WEB-INF/xwiki.cfg) and potentially host system files (e.g., /etc/passwd), depending on deployment depth and permissions. The attack requires no privileges or user interaction and can be executed remotely over a network.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive files such as WEB-INF/xwiki.cfg, which may contain configuration data or credentials. If exploited, it could result in data breaches, violating GDPR's data protection requirements or HIPAA's safeguards for protected health information.

Mitigation Strategies

Upgrade XWiki to version 17.10.5 or 18.2.0 immediately. If upgrading is not possible, switch to an unaffected application server like Jetty versions below 12 or Tomcat. Restrict file permissions on the server to limit access to sensitive files like WEB-INF/xwiki.cfg.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-34151. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart