CVE-2026-23734
- Source
- https://cve.org/CVERecord?id=CVE-2026-23734
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-23734.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-23734
- Aliases
- Published
- 2026-05-20T18:39:32Z
- Modified
- 2026-08-12T15:32:52Z
- Severity
-
- 9.3 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- XWiki Platform: Path traversal via resources parameter in ssx and jsx endpoints when using leading slash
- Details
-
XWiki Platform is a generic wiki platform. Versions prior to 18.1.0-rc-1, 17.10.3, 17.4.9, and 16.10.17 allow access to read configuration files by using URLs such as http://localhost:8080/bin/ssx/Main/WebHome?resource=/../../WEB-INF/xwiki.cfg&minify=false, leading to Path Traversal. The vulnerability is can be exploited via resources parameter the ssx and jsx endpoints by using leading slashes. This issue has been patched in 18.1.0-rc-1, 17.10.3, 17.4.9, 16.10.17.
- Database specific
{ "cna_assigner": "GitHub_M", "cwe_ids": [ "CWE-23" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23734.json" }- References
-
- https://jira.xwiki.org/browse/XCOMMONS-3547
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23734.json
- https://github.com/xwiki/xwiki-commons/security/advisories/GHSA-xq3r-2qv5-vqqm
- https://nvd.nist.gov/vuln/detail/CVE-2026-23734
- https://github.com/xwiki/xwiki-commons/commit/a979cafd89f6a9c9c0b9ab19744d672df64429bf
Affected packages
Git / github.com/xwiki/xwiki-commons
Affected ranges
- Type
- GIT
- Repo
- https://github.com/xwiki/xwiki-commons
- Events
-
IntroducedIntroducedIntroducedIntroducedFixedFixedFixedFixedFixed
- Database specific
-
Show details
{ "extracted_events": [ { "introduced": "4.2-milestone-2" }, { "fixed": "16.10.17" }, { "introduced": "17.0.0-rc-1" }, { "fixed": "17.4.9" }, { "introduced": "17.5.0" }, { "fixed": "17.10.3" }, { "introduced": "18.0.0-rc-1" }, { "fixed": "18.1.0-rc-1" } ], "source": [ "AFFECTED_FIELD", "REFERENCES" ] }
Database specific
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-23734.json"
vanir_signatures
[
{
"deprecated": false,
"digest": {
"line_hashes": [
"2948023592146722606491836670185018653",
"274104245728058916856442530221646087902",
"138909001934265186495120935438141488604",
"189722264989612013457392855371978334318",
"325443459546169335721702422478700535511",
"248308437212831236273076095235174256875",
"41782896662997759645816495766191793731",
"188711983414259152124599187542176373177"
],
"threshold": 0.9
},
"id": "CVE-2026-23734-12dea3f1",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/xwiki/xwiki-commons/commit/a979cafd89f6a9c9c0b9ab19744d672df64429bf",
"target": {
"file": "xwiki-commons-core/xwiki-commons-classloader/xwiki-commons-classloader-api/src/test/java/org/xwiki/classloader/internal/ClassLoaderUtilsTest.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"308989672931439701215515641288251888827",
"156634038738375471232741595136121852381",
"50227681565533930959011950212750396681",
"160201200821243622785031614106229528724",
"175225849133164330438125518539838979339",
"249366572244995496268506381131438116119",
"301035959686307071156626950511214637879",
"51077397778220341750957244371873746038",
"270872738632402461207564462793543829467",
"77959831762428945948369470785563242808",
"157791561003054887425238913442336212630"
],
"threshold": 0.9
},
"id": "CVE-2026-23734-6b1fedcf",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/xwiki/xwiki-commons/commit/a979cafd89f6a9c9c0b9ab19744d672df64429bf",
"target": {
"file": "xwiki-commons-core/xwiki-commons-classloader/xwiki-commons-classloader-api/src/main/java/org/xwiki/classloader/internal/ClassLoaderUtils.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "28893803558754679635221987699601855831",
"length": 1000
},
"id": "CVE-2026-23734-81b567d6",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/xwiki/xwiki-commons/commit/a979cafd89f6a9c9c0b9ab19744d672df64429bf",
"target": {
"file": "xwiki-commons-core/xwiki-commons-classloader/xwiki-commons-classloader-api/src/test/java/org/xwiki/classloader/internal/ClassLoaderUtilsTest.java",
"function": "getResource"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "148662974130918769542307519163597290942",
"length": 1002
},
"id": "CVE-2026-23734-86ff1272",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/xwiki/xwiki-commons/commit/a979cafd89f6a9c9c0b9ab19744d672df64429bf",
"target": {
"file": "xwiki-commons-core/xwiki-commons-classloader/xwiki-commons-classloader-api/src/test/java/org/xwiki/classloader/internal/ClassLoaderUtilsTest.java",
"function": "getResourceAsStream"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "77918730999879680585106513262093506912",
"length": 640
},
"id": "CVE-2026-23734-b05e300f",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/xwiki/xwiki-commons/commit/a979cafd89f6a9c9c0b9ab19744d672df64429bf",
"target": {
"file": "xwiki-commons-core/xwiki-commons-classloader/xwiki-commons-classloader-api/src/main/java/org/xwiki/classloader/internal/ClassLoaderUtils.java",
"function": "resolveResourceName"
}
}
]
vanir_signatures_modified
"2026-08-12T15:32:52Z"