CVE-2026-23734
Published: May 20, 2026
Modified: May 26, 2026
Description
XWiki Platform is a generic wiki platform. Versions prior to 18.1.0-rc-1, 17.10.3, 17.4.9, and 16.10.17 allow access to read configuration files by using URLs such as http://localhost:8080/bin/ssx/Main/WebHome?resource=/../../WEB-INF/xwiki.cfg&minify=false, leading to Path Traversal. The vulnerability is can be exploited via resources parameter the ssx and jsx endpoints by using leading slashes. This issue has been patched in 18.1.0-rc-1, 17.10.3, 17.4.9, 16.10.17.
| Vendor | Product | Versions |
|---|---|---|
xwiki | xwiki-commons | affected >= 4.2-milestone-2, < 16.10.17affected >= 17.0.0-rc-1, < 17.4.9affected >= 17.5.0, < 17.10.3affected >= 18.0.0-rc-1, < 18.1.0-rc-1 |
Weaknesses (CWE)
References
Security Training
Train your team to recognize and prevent security threats with our comprehensive security awareness program.
Start TrainingVulnerability Scanning
Discover vulnerabilities in your applications and infrastructure before attackers do.
Scan Now