EUVD-2026-77676
GHSA-qj4x-9g63-25g6
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLocate XWiki-on-Jetty-12 host
-
DeliveryCraft double-encoded ../ skin URL
-
ExploitBypass path normalization in resource resolver
-
ExecutionRead config or OS file
-
ImpactExfiltrate credentials and secrets
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path traversal prevention
|
| Exploitation Conditions | Exploitation requires the target to be XWiki (before 17.10.5 / 18.2.0) served by Jetty version 12 or later - Tomcat and Jetty <12 are not affected, which is the single strongest limiting factor. The request must target the skin resource action (/xwiki/bin/skin/) using doubly URL-encoded traversal segments (..%252f). Disclosure of in-webapp files (WEB-INF/xwiki.cfg, Hibernate config) works on any affected Jetty-12 deployment; disclosure of files outside the webapp (e.g. /etc/passwd) additionally requires the webapp to sit exactly as many directory levels below '/' as there are ../ segments in the URL (five levels in the official Docker image) and requires the Jetty OS process to have read permission on the target file. No authentication or user interaction is indicated for the skin endpoint, though no CVSS vector was supplied to formally confirm the privilege level. |
| Impact | No CVSS vector, EPSS score, or KEV entry was provided, so quantitative risk signals are absent and must be inferred. Qualitatively the risk is meaningful: the attack is over the network against the public skin endpoint, requires no authentication in typical XWiki deployments, and yields confidentiality-only impact (arbitrary file read, no write or availability loss). The most damaging out-of-webapp read (e.g. /etc/passwd) is conditional - it only works when the webapp is exactly N directory levels below '/', matching the ../ count, which the Docker image happens to satisfy - so full OS file disclosure is deployment-dependent. However, reading in-webapp secrets like WEB-INF/xwiki.cfg and Hibernate DB credentials works regardless of depth, making this a reliable secret-disclosure primitive that can seed follow-on attacks. Net: a genuine priority for internet-facing XWiki-on-Jetty-12 instances, lower urgency for those on Tomcat or Jetty <12. |
| Exploit ScenarioDerived | An unauthenticated attacker discovers an internet-facing XWiki instance running the Docker image (Jetty 12), then requests http://[host]/xwiki/bin/skin/..%252f/..%252fWEB-INF/xwiki.cfg to retrieve the XWiki and Hibernate configuration, including database credentials. Because the advisory publishes the exact working URLs, no exploit development is needed; the attacker can also attempt the deeper ..%252f chain to /etc/passwd where the webapp depth matches. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 07, 2026
Path traversal in XWiki running on Jetty 12+ lets remote users read arbitrary files the Jetty process can access by sending doubly URL-encoded '../' sequences to the skin resource endpoint (e.g. /xwiki/bin/skin/..%252f/..). Depending on how deep the webapp sits below root, this exposes both in-webapp secrets such as WEB-INF/xwiki.cfg and Hibernate configuration, and out-of-webapp OS files like /etc/passwd. No public exploit or active exploitation is tracked, but the vendor advisory (GHSA-qj4x-9g63-25g6) itself publishes working request URLs, so weaponization is trivial.
RemediationAI
Vendor-released patch: XWiki 17.10.5 and 18.2.0 - upgrade to one of these fixed versions as the primary remediation (advisory: https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-qj4x-9g63-25g6; upstream fix: https://github.com/xwiki/xwiki-commons/pull/1675; tracking: https://jira.xwiki.org/browse/XCOMMONS-3594 and https://jira.xwiki.org/browse/XWIKI-24075). If immediate patching is not possible, the vendor-suggested workaround is to switch the application server away from Jetty 12+ to Tomcat, or to Jetty <12 for XWiki < 17, since those servers normalize the malicious encoding - the trade-off is a non-trivial infrastructure change and revalidation of the deployment. As an additional compensating control, place a reverse proxy or WAF rule in front of XWiki to reject requests to the /bin/skin/ path containing encoded traversal patterns (%252f, %2e%2e, '..'), and ensure the Jetty OS user has least-privilege filesystem access so that even a successful traversal cannot reach sensitive OS files; note that overly broad proxy rules can break legitimate skin resource loading and should be tested.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 3 packages in maven, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
XWiki is a Java-based open-source enterprise wiki platform; the vulnerable code lives in xwiki-platform-oldcore (pkg:maven/org.xwiki.platform:xwiki-platform-oldcore) and the fix was staged in xwiki-commons (PR #1675). The flaw is a classic CWE-24 Path Traversal ('../filedir'): the skin action resolves a client-supplied resource path without fully canonicalizing it. The bug is triggered only under Jetty 12+, whose URI handling passes doubly-encoded percent sequences (%252f decodes to %2f then to '/') through to XWiki's resource resolver, letting the '..%252f' segments escape the intended skin directory. Earlier Jetty (<12) and Tomcat normalize or reject these sequences, which is why they are reported as unaffected.
Know when Docker gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Remote unauthenticated request to the public skin endpoint (AV:N/PR:N/UI:N) with reliable in-webapp file read gives AC:L and C:H; no integrity or availability impact, scope unchanged within the app process.
Primary rating from Vendor (https://github.com/xwiki/xwiki-platform).
CVSS VectorVendor: https://github.com/xwiki/xwiki-platform
Lifecycle Timeline
1DescriptionCVE.org
Impact
With Jetty 12+ a user can craft a URL to access any resource the Jetty instance is allowed to access.
For example http://[host]/xwiki/bin/skin/..%252f/..%252f..%252f..%252f..%252f..%252f..%252f..%252fetc/passwd allows downloading the content of the /etc/passwd file, provided Jetty is allowed to read it, and if your XWiki webapp is located exactly 5 levels below / (like /var/lib/jetty/webapps/xwiki, which is the case in the docker image, for example).
Another example which does not go out of the XWiki webapp, but it's still a vulnerability (since users should not be allowed to access Hibernate or XWiki configuration files) is http://[host]/xwiki/bin/skin/..%252f/..%252fWEB-INF/xwiki.cfg.
Patches
This vulnerability has been patched in XWiki 17.10.5 and 18.2.0.
Workarounds
A possible workaround is to use a different application server, like Jetty < 12 (in the case of XWiki < 17) or Tomcat, which don't seem to be impacted.
Resources
- https://jira.xwiki.org/browse/XWIKI-24075
- https://jira.xwiki.org/browse/XCOMMONS-3594
For more information
If there are any questions or comments about this advisory:
- Open an issue in Jira XWiki.org
- Send an email to the [Security Mailing List](mailto:security@xwiki.org)
Attribution
Lê Ngọc Khoa reported the vulnerability.
Executive ViewAI
XWiki deployments on Jetty 12 and later contain a path traversal vulnerability allowing remote file disclosure, including database credentials, encryption keys, and sensitive application configuration. The vendor has published patch details with working proof-of-concept URLs, requiring immediate remediation to prevent credential theft and potential system compromise.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
An issue was discovered in Appsmith before 1.52. Rated critical severity (CVSS 9.8), this vulnerability is remotely expl
runc through version 1.0-rc6 (used in Docker before 18.09.2) contains a container escape vulnerability that allows attac
Netmaker makes networks with WireGuard. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no a
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
The News & Blog Designer Pack - WordPress Blog Plugin - (Blog Post Grid, Blog Post Slider, Blog Post Carousel, Blog Post
Path traversal in JFrog Artifactory (CWE-22) enables an authenticated low-privilege user to write data outside the inten
Docker 1.3.2 allows remote attackers to execute arbitrary code with root privileges via a crafted (1) image or (2) build
Remote code execution in Gogs through 0.14.2 allows authenticated users (and unauthenticated attackers on default-config
Unauthenticated remote command injection in SGWBOX N3 firmware 2.0.25 lets attackers execute arbitrary operating-system
Remote code execution in Flowise before 3.1.2 allows any authenticated user (or API caller with chatflow view/update per
Remote code execution in NocoBase Workflow Script Node (npm @nocobase/plugin-workflow-javascript) allows authenticated l
Docker Desktop Community Edition before 2.1.0.1 allows local users to gain privileges by placing a Trojan horse docker-c
Exploit-DB