← Vulnerability feed

Vulnerability record · CVE-2026-34151 · published 14 September 2026

CVE-2026-34151: XWiki Platform is a generic wiki platform.

XWiki Platform is a generic wiki platform. Prior to 17.10.5 and 18.2.0, the /skin/ action in com.xpn.xwiki.web.SkinAction can resolve double-encoded parent-directory segments outside the intended skin or web-application resource prefix when Jetty 12 or later decodes the request path. The affected lookup is replaced with Environment.getResourceAsStream(String, String), which constrains a resource to its expected prefix. An unauthenticated remote attacker can use the vulnerable behavior to read arbitrary resources permitted to the Jetty process, including WEB-INF/xwiki.cfg and, depending on deployment depth and operating-system permissions, host files. Tomcat and Jetty versions before 12 do not appear affected. This issue is fixed in versions 17.10.5 and 18.2.0.

8.2 CVSS 4.0 High EPSS 1.1% · top 36.8% CWE-24 · CWE-24 Received
8.2CVSS 4.0 base score
1.1%EPSS exploitation probability, 30 days
NoNot in CISA KEV
0Affected product versions listed by NVD
8References
14 Sep 2026Last modified by NVD

Description

XWiki Platform is a generic wiki platform. Prior to 17.10.5 and 18.2.0, the /skin/ action in com.xpn.xwiki.web.SkinAction can resolve double-encoded parent-directory segments outside the intended skin or web-application resource prefix when Jetty 12 or later decodes the request path. The affected lookup is replaced with Environment.getResourceAsStream(String, String), which constrains a resource to its expected prefix. An unauthenticated remote attacker can use the vulnerable behavior to read arbitrary resources permitted to the Jetty process, including WEB-INF/xwiki.cfg and, depending on deployment depth and operating-system permissions, host files. Tomcat and Jetty versions before 12 do not appear affected. This issue is fixed in versions 17.10.5 and 18.2.0.

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

References

LinkTags
https://github.com/xwiki/xwiki-commons/pull/1675
https://github.com/xwiki/xwiki-platform/commit/79eba8655f3a96021a8e7ad07956e48d20a82383
https://github.com/xwiki/xwiki-platform/commit/f7b33704083d3b4e45d1b9fc1e2cc33c66855f85
https://github.com/xwiki/xwiki-platform/releases/tag/xwiki-platform-17.10.5
https://github.com/xwiki/xwiki-platform/releases/tag/xwiki-platform-18.2.0
https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-qj4x-9g63-25g6
https://jira.xwiki.org/browse/XCOMMONS-3594
https://jira.xwiki.org/browse/XWIKI-24075

Track CVE-2026-34151 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.6CVE-2026-20349Cisco ASA and FTD SSL VPN HTTP request handling denial of serviceCisco Secure Firewall ASA and FTD software fail to properly check errors when processing HTTP requests in the Remote Access SSL VPN service. An unaut…KEVEPSS 1.0%analysed8.8CVE-2025-27920Output Messenger directory traversal allows arbitrary file accessOutput Messenger before 2.0.63 mishandles file paths, allowing directory traversal via ../ sequences in parameters. An attacker can read files outsid…KEVEPSS 1.9%analysed

Source: NIST National Vulnerability Database (record CVE-2026-34151), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.