Path Traversal in Xwiki Xwiki-Commons
CVE-2026-23734
XWiki Platform is a generic wiki platform. Versions prior to 18.1.0-rc-1, 17.10.3, 17.4.9, and 16.10.17 allow access to read configuration files by using URLs such as http://localhost:8080/bin/ssx/Main/WebHome?resource=/../../WEB-INF/xwiki.cfg&minify=false, leading to Path Traversal. The vulnerability is can be exploited via resources parameter the ssx and jsx endpoints by using leading slashes. This issue has been patched in 18.1.0-rc-1, 17.10.3, 17.4.9, 16.10.17.
Published · last modified .
EPSS exploit prediction
EPSS: 0.185 (97.3th percentile), scored .
Moderate probability of exploitation in the next 30 days — watch for active exploitation reports. 97th percentile — 97.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.196 · newest: 0.185 · change: -0.010
Affected products
- Xwiki Xwiki-Commons — versions >= 17.0.0-rc-1, < 17.4.9, >= 17.5.0, < 17.10.3, < 16.10.17