Which versions of XWiki are affected by CVE-2026-34151?

XWiki deployments on Jetty 12 and later contain a path traversal vulnerability allowing remote file disclosure, including database credentials, encryption keys, and sensitive application…. A patch is available.

How to fix or mitigate CVE-2026-34151?

Within 24 hours: Identify all XWiki instances, confirm Jetty version and XWiki version to determine exposure. Within 7 days: Apply vendor-released patch to all affected XWiki installations; verify patch deployment. Within 30 days: Scan web server logs for exploitation attempts (look for requests containing '%2f' or '../' patterns in the skin resource endpoint), and confirm patch coverage across all systems.

XWiki CVE-2026-34151

HIGH

Path Traversal: '../filedir' (CWE-24)

2026-07-07 https://github.com/xwiki/xwiki-platform

GHSA-qj4x-9g63-25g6

Atlassian Information Disclosure Tomcat Docker

Severity by source

vuln.today AI

7.5 HIGH

Remote unauthenticated request to the public skin endpoint (AV:N/PR:N/UI:N) with reliable in-webapp file read gives AC:L and C:H; no integrity or availability impact, scope unchanged within the app process.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Estimated by vuln.today — no official severity rating has been published for this CVE yet.

Lifecycle Timeline

Analysis Generated

Jul 07, 2026 - 13:35 vuln.today

DescriptionCVE.org

Impact

With Jetty 12+ a user can craft a URL to access any resource the Jetty instance is allowed to access.

For example http://[host]/xwiki/bin/skin/..%252f/..%252f..%252f..%252f..%252f..%252f..%252f..%252fetc/passwd allows downloading the content of the /etc/passwd file, provided Jetty is allowed to read it, and if your XWiki webapp is located exactly 5 levels below / (like /var/lib/jetty/webapps/xwiki, which is the case in the docker image, for example).

Another example which does not go out of the XWiki webapp, but it's still a vulnerability (since users should not be allowed to access Hibernate or XWiki configuration files) is http://[host]/xwiki/bin/skin/..%252f/..%252fWEB-INF/xwiki.cfg.

Patches

This vulnerability has been patched in XWiki 17.10.5 and 18.2.0.

Workarounds

A possible workaround is to use a different application server, like Jetty < 12 (in the case of XWiki < 17) or Tomcat, which don't seem to be impacted.

Resources

https://jira.xwiki.org/browse/XWIKI-24075
https://jira.xwiki.org/browse/XCOMMONS-3594

For more information

If there are any questions or comments about this advisory:

Open an issue in Jira XWiki.org
Send an email to the [Security Mailing List](mailto:security@xwiki.org)

Attribution

Lê Ngọc Khoa reported the vulnerability.

AnalysisAI

Path traversal in XWiki running on Jetty 12+ lets remote users read arbitrary files the Jetty process can access by sending doubly URL-encoded '../' sequences to the skin resource endpoint (e.g. /xwiki/bin/skin/..%252f/..). …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Locate XWiki-on-Jetty-12 host

Delivery

Craft double-encoded ../ skin URL

Exploit

Bypass path normalization in resource resolver

Execution

Read config or OS file

Impact

Exfiltrate credentials and secrets

Access

Locate XWiki-on-Jetty-12 host

Delivery

Craft double-encoded ../ skin URL

Exploit

Bypass path normalization in resource resolver

Execution

Read config or OS file

Impact

Exfiltrate credentials and secrets

Vulnerability AssessmentAI

Exploitation	Exploitation requires the target to be XWiki (before 17.10.5 / 18.2.0) served by Jetty version 12 or later - Tomcat and Jetty <12 are not affected, which is the single strongest limiting factor. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	No CVSS vector, EPSS score, or KEV entry was provided, so quantitative risk signals are absent and must be inferred. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An unauthenticated attacker discovers an internet-facing XWiki instance running the Docker image (Jetty 12), then requests http://[host]/xwiki/bin/skin/..%252f/..%252fWEB-INF/xwiki.cfg to retrieve the XWiki and Hibernate configuration, including database credentials. Because the advisory publishes the exact working URLs, no exploit development is needed; the attacker can also attempt the deeper ..%252f chain to /etc/passwd where the webapp depth matches.
Remediation	Vendor-released patch: XWiki 17.10.5 and 18.2.0 - upgrade to one of these fixed versions as the primary remediation (advisory: https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-qj4x-9g63-25g6; upstream fix: https://github.com/xwiki/xwiki-commons/pull/1675; tracking: https://jira.xwiki.org/browse/XCOMMONS-3594 and https://jira.xwiki.org/browse/XWIKI-24075). … Detailed patch versions, workarounds, and compensating controls in full report.