CVE-2026-34151
HighCVSS 8.2Exploitation Probability (EPSS)
Low risk44th percentile - higher than 44% of all known CVEs
Summary
In XWiki Platform prior to 17.10.5 and 18.2.0, the /skin/ action in SkinAction can resolve double-encoded parent-directory segments outside the intended resource prefix when Jetty 12 or later decodes the request path. An unauthenticated remote attacker can read arbitrary resources permitted to the Jetty process, including WEB-INF/xwiki.cfg and potentially host files. The issue is fixed in versions 17.10.5 and 18.2.0.
Risk Assessment
An unauthenticated attacker may access configuration files and potentially sensitive system data, leading to further escalation and information disclosure. The risk particularly affects XWiki installations running on Jetty 12 or later.
Recommendation
Update XWiki Platform to version 17.10.5 or 18.2.0. If updating is not possible, consider restricting access to the /skin/ action or reviewing the Jetty server configuration.
Other vulnerabilities in XWiki Platform
See all- CVE-2026-33137Critical
A vulnerability in XWiki Platform versions starting with 15.10.6 and prior to 18.1.0-rc-1, 17.10.3, 17.4.9, and 16.10.17. The POST /wikis/{wikiName} API performs a XAR import without authentication or authorization checks, allowing an unauthenticated attacker to create or update documents in the target wiki.
- CVE-2026-23734Critical
A vulnerability in XWiki Platform allows reading configuration files by manipulating the resource parameter in ssx and jsx endpoints, leading to Path Traversal. Affects versions prior to 18.1.0-rc-1, 17.10.3, 17.4.9, and 16.10.17.
- CVE-2026-33229Critical
XWiki Platform is a wiki platform. Prior to versions 17.4.8 and 17.10.1, an improperly protected scripting API allows users with script right to bypass the Velocity sandbox and execute arbitrary Python scripts, leading to full access to the XWiki instance.
- CVE-2025-24893CriticalActively exploited
XWiki Platform allows any guest to perform arbitrary remote code execution through a request to `SolrSearch`. This impacts the confidentiality, integrity, and availability of the whole XWiki installation.
- CVE-2023-40573Critical
XWiki Platform has a vulnerability that allows remote code execution by an attacker with edit rights on the wiki. It exploits a flaw in the job scheduler and an issue with content author authorization. This vulnerability has been patched in XWiki versions 14.10.9 and 15.4RC1.
- CVE-2023-40572Critical
XWiki Platform is vulnerable to a CSRF attack in the create action, allowing remote code execution by users with appropriate permissions. If a user with script rights sees a specific log message, the XWiki installation is at risk.
- CVE-2023-40177Critical
XWiki Platform allows registered users to execute arbitrary scripts in the content field of their profile page, leading to rights escalation. This issue has been present since version 4.3M2 when support for the content field was added in the AppWithinMinutes application.
- CVE-2023-40176Critical
XWiki Platform has a stored XSS vulnerability that can be exploited by registered users by setting a malicious payload in the time zone user preference. Although the time zone is selected from a dropdown, it can still be set using JavaScript or the appropriate URL.
- CVE-2023-37914Critical
XWiki Platform allows users who can view `Invitation.WebHome` to execute arbitrary script macros, including Groovy and Python, leading to remote code execution. This vulnerability allows unrestricted read and write access to all wiki contents.
- CVE-2023-37462Critical
XWiki Platform has a vulnerability due to improper escaping in the `SkinsCode.XWikiSkinsSheet` document. This allows attackers to execute arbitrary script macros, including Groovy and Python, leading to remote code execution and unrestricted access to wiki content.
Original NVD description (English source)
XWiki Platform is a generic wiki platform. Prior to 17.10.5 and 18.2.0, the /skin/ action in com.xpn.xwiki.web.SkinAction can resolve double-encoded parent-directory segments outside the intended skin or web-application resource prefix when Jetty 12 or later decodes the request path. The affected lookup is replaced with Environment.getResourceAsStream(String, String), which constrains a resource to its expected prefix. An unauthenticated remote attacker can use the vulnerable behavior to read arbitrary resources permitted to the Jetty process, including WEB-INF/xwiki.cfg and, depending on deployment depth and operating-system permissions, host files. Tomcat and Jetty versions before 12 do not appear affected. This issue is fixed in versions 17.10.5 and 18.2.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS