GHSA-qj4x-9g63-25g6

Source

https://github.com/advisories/GHSA-qj4x-9g63-25g6

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-qj4x-9g63-25g6/GHSA-qj4x-9g63-25g6.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-qj4x-9g63-25g6

Aliases

CVE-2026-34151

Published

2026-07-07T13:01:21Z

Modified

2026-07-07T13:26:30Z

Severity

8.2 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

XWiki Platform Old Core: Resource path traversal via /skin/ action endpoint in Jetty 12+

Details

Impact

With Jetty 12+ a user can craft a URL to access any resource the Jetty instance is allowed to access.

For example http://[host]/xwiki/bin/skin/..%252f/..%252f..%252f..%252f..%252f..%252f..%252f..%252fetc/passwd allows downloading the content of the /etc/passwd file, provided Jetty is allowed to read it, and if your XWiki webapp is located exactly 5 levels below / (like /var/lib/jetty/webapps/xwiki, which is the case in the docker image, for example).

Another example which does not go out of the XWiki webapp, but it's still a vulnerability (since users should not be allowed to access Hibernate or XWiki configuration files) is http://[host]/xwiki/bin/skin/..%252f/..%252fWEB-INF/xwiki.cfg.

Patches

This vulnerability has been patched in XWiki 17.10.5 and 18.2.0.

Workarounds

A possible workaround is to use a different application server, like Jetty < 12 (in the case of XWiki < 17) or Tomcat, which don't seem to be impacted.

Resources

For more information

If there are any questions or comments about this advisory:

Open an issue in Jira XWiki.org
Send an email to the Security Mailing List

Attribution

Lê Ngọc Khoa reported the vulnerability.

Database specific

{
    "cwe_ids":  [
        "CWE-24"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-07-07T13:01:21Z",
    "nvd_published_at":  null,
    "severity":  "HIGH"
}

References

Affected packages

Maven / org.xwiki.platform:xwiki-platform-oldcore

Package

Name: org.xwiki.platform:xwiki-platform-oldcore; View open source insights on deps.dev
Purl: pkg:maven/org.xwiki.platform/xwiki-platform-oldcore

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

17.10.5

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-qj4x-9g63-25g6/GHSA-qj4x-9g63-25g6.json"

Maven / org.xwiki.platform:xwiki-platform-oldcore

Package

Name: org.xwiki.platform:xwiki-platform-oldcore; View open source insights on deps.dev
Purl: pkg:maven/org.xwiki.platform/xwiki-platform-oldcore

Affected ranges

Type: ECOSYSTEM
Events: Introduced

18.0.0-rc-1

Fixed

18.2.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-qj4x-9g63-25g6/GHSA-qj4x-9g63-25g6.json"