Which versions of XWiki are affected by CVE-2026-34151?

XWiki deployments on Jetty 12 and later contain a path traversal vulnerability allowing remote file disclosure, including database credentials, encryption keys, and sensitive application…. A patch is available.

How to fix or mitigate CVE-2026-34151?

Within 24 hours: Identify all XWiki instances, confirm Jetty version and XWiki version to determine exposure. Within 7 days: Apply vendor-released patch to all affected XWiki installations; verify patch deployment. Within 30 days: Scan web server logs for exploitation attempts (look for requests containing '%2f' or '../' patterns in the skin resource endpoint), and confirm patch coverage across all systems.

XWiki CVE-2026-34151

HIGH

Path Traversal: '../filedir' (CWE-24)

2026-07-07 https://github.com/xwiki/xwiki-platform

GHSA-qj4x-9g63-25g6

Atlassian Information Disclosure Tomcat Docker

Severity by source

vuln.today AI

7.5 HIGH

Remote unauthenticated request to the public skin endpoint (AV:N/PR:N/UI:N) with reliable in-webapp file read gives AC:L and C:H; no integrity or availability impact, scope unchanged within the app process.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Estimated by vuln.today — no official severity rating has been published for this CVE yet.

Lifecycle Timeline

Analysis Generated

Jul 07, 2026 - 13:35 vuln.today

DescriptionCVE.org

Impact

With Jetty 12+ a user can craft a URL to access any resource the Jetty instance is allowed to access.

For example http://[host]/xwiki/bin/skin/..%252f/..%252f..%252f..%252f..%252f..%252f..%252f..%252fetc/passwd allows downloading the content of the /etc/passwd file, provided Jetty is allowed to read it, and if your XWiki webapp is located exactly 5 levels below / (like /var/lib/jetty/webapps/xwiki, which is the case in the docker image, for example).

Another example which does not go out of the XWiki webapp, but it's still a vulnerability (since users should not be allowed to access Hibernate or XWiki configuration files) is http://[host]/xwiki/bin/skin/..%252f/..%252fWEB-INF/xwiki.cfg.

Patches

This vulnerability has been patched in XWiki 17.10.5 and 18.2.0.

Workarounds

A possible workaround is to use a different application server, like Jetty < 12 (in the case of XWiki < 17) or Tomcat, which don't seem to be impacted.

Resources

https://jira.xwiki.org/browse/XWIKI-24075
https://jira.xwiki.org/browse/XCOMMONS-3594

For more information

If there are any questions or comments about this advisory:

Open an issue in Jira XWiki.org
Send an email to the [Security Mailing List](mailto:security@xwiki.org)

Attribution

Lê Ngọc Khoa reported the vulnerability.

AnalysisAI

Path traversal in XWiki running on Jetty 12+ lets remote users read arbitrary files the Jetty process can access by sending doubly URL-encoded '../' sequences to the skin resource endpoint (e.g. /xwiki/bin/skin/..%252f/..). Depending on how deep the webapp sits below root, this exposes both in-webapp secrets such as WEB-INF/xwiki.cfg and Hibernate configuration, and out-of-webapp OS files like /etc/passwd. No public exploit or active exploitation is tracked, but the vendor advisory (GHSA-qj4x-9g63-25g6) itself publishes working request URLs, so weaponization is trivial.

Technical ContextAI

XWiki is a Java-based open-source enterprise wiki platform; the vulnerable code lives in xwiki-platform-oldcore (pkg:maven/org.xwiki.platform:xwiki-platform-oldcore) and the fix was staged in xwiki-commons (PR #1675). The flaw is a classic CWE-24 Path Traversal ('../filedir'): the skin action resolves a client-supplied resource path without fully canonicalizing it. The bug is triggered only under Jetty 12+, whose URI handling passes doubly-encoded percent sequences (%252f decodes to %2f then to '/') through to XWiki's resource resolver, letting the '..%252f' segments escape the intended skin directory. Earlier Jetty (<12) and Tomcat normalize or reject these sequences, which is why they are reported as unaffected.

RemediationAI

Vendor-released patch: XWiki 17.10.5 and 18.2.0 - upgrade to one of these fixed versions as the primary remediation (advisory: https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-qj4x-9g63-25g6; upstream fix: https://github.com/xwiki/xwiki-commons/pull/1675; tracking: https://jira.xwiki.org/browse/XCOMMONS-3594 and https://jira.xwiki.org/browse/XWIKI-24075). If immediate patching is not possible, the vendor-suggested workaround is to switch the application server away from Jetty 12+ to Tomcat, or to Jetty <12 for XWiki < 17, since those servers normalize the malicious encoding - the trade-off is a non-trivial infrastructure change and revalidation of the deployment. As an additional compensating control, place a reverse proxy or WAF rule in front of XWiki to reject requests to the /bin/skin/ path containing encoded traversal patterns (%252f, %2e%2e, '..'), and ensure the Jetty OS user has least-privilege filesystem access so that even a successful traversal cannot reach sensitive OS files; note that overly broad proxy rules can break legitimate skin resource loading and should be tested.