CVE-2026-23734 XWiki Platform: Path traversal via resources parameter in ssx and jsx endpoints when using leading slash
Attackers can read sensitive configuration files via path traversal in ssx and jsx endpoints, affecting XWiki Platform users.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-23734?
CVE-2026-23734 is a critical path traversal vulnerability in xwiki-commons, published on 20 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
XWiki Platform is a generic wiki platform. Versions prior to 18.1.0-rc-1, 17.10.3, 17.4.9, and 16.10.17 allow access to read configuration files by using URLs such as http://localhost:8080/bin/ssx/Main/WebHome?resource=/../../WEB-INF/xwiki.cfg&minify=false, leading to Path Traversal. The vulnerability is can be exploited via resources parameter the ssx and jsx endpoints by using leading slashes. This issue has been patched in 18.1.0-rc-1, 17.10.3, 17.4.9, 16.10.17.
Weakness: CWE-23
Which versions are affected by CVE-2026-23734?
8 open source packages ship an affected version, including org.xwiki.commons:xwiki-commons-classloader-api.
| Package | Affected | Fixed in |
|---|---|---|
org.xwiki.commons:xwiki-commons-classloader-api Maven | From 17.0.0-rc-1 | 17.4.9 |
org.xwiki.commons:xwiki-commons-classloader-api Maven | From 17.0.0-rc-1 | 17.4.9 |
org.xwiki.commons:xwiki-commons-classloader-api Maven | From 17.5.0 | 17.10.3 |
org.xwiki.commons:xwiki-commons-classloader-api Maven | From 17.5.0 | 17.10.3 |
org.xwiki.commons:xwiki-commons-classloader-api Maven | From 18.0.0-rc-1 | 18.1.0-rc-1 |
org.xwiki.commons:xwiki-commons-classloader-api Maven | From 18.0.0-rc-1 | 18.1.0-rc-1 |
2 more packages
org.xwiki.commons:xwiki-commons-classloader-api Maven | From 4.2-milestone-2 | 16.10.17 |
org.xwiki.commons:xwiki-commons-classloader-api Maven | From 4.2-milestone-2 | 16.10.17 |
How do I fix CVE-2026-23734?
Upgrade org.xwiki.commons:xwiki-commons-classloader-api to a fixed version for your release line: 17.4.9, 17.10.3, 18.1.0-rc-1 or 16.10.17.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-23734 being exploited?
There is no known exploitation of CVE-2026-23734 in the wild and no public exploit code.
Sources
Also known as GHSA-xq3r-2qv5-vqqm.