XWiki Platform CVE-2026-48047

Exploitation requires two concrete preconditions: (1) the attacker must hold admin rights to at least one subwiki within the target XWiki instance - unauthenticated or low-privilege users cannot trigger this path; (2) the attacker must be able to publish a malicious WebJar extension to an extension repository that is actively configured and trusted by the XWiki instance, and that extension must be installed on the wiki (either by the attacker themselves if they have install rights, or by a higher-privileged administrator). Exploitation is further constrained to XWiki instances running affected version ranges (9.6-rc-1 to 16.10.16, 17.0.0-rc-1 to 17.4.8, or 17.5.0-rc-1 to 17.10.2). The requirement to control a repository entry point or convince an admin to install a malicious package significantly limits opportunistic exploitation.

No CVSS vector is available for this CVE, preventing quantitative scoring comparison. The advisory description implies an elevated-privilege, multi-step attack chain: the attacker must already hold admin rights on at least one subwiki and must be able to publish a malicious extension to a repository trusted and configured in the target instance. These preconditions substantially reduce the realistic attack surface compared to unauthenticated network-exploitable vulnerabilities. No EPSS score is available and the CVE is not listed in CISA KEV, indicating no confirmed active exploitation. No public POC has been identified. Despite the high theoretical impact (arbitrary file write enabling superadmin credential reset and full instance takeover), the exploitation bar is elevated enough that this should be treated as a medium-urgency patch rather than an emergency, except in multi-tenant environments where subwiki admin roles are granted to semi-trusted or external parties - where it should be treated as high priority.

An attacker who holds subwiki admin access publishes a crafted WebJar extension to a repository configured in the target XWiki instance; the JAR contains entries with path traversal sequences such as ../../webapps/xwiki/WEB-INF/xwiki.cfg. Once the extension is installed - either by the attacker directly or by persuading another administrator - FilesystemResourceReferenceCopier extracts the malicious entries outside the export directory, overwriting XWiki configuration files and enabling the attacker to reset the superadmin password and achieve full instance compromise. No public POC code has been identified, but the path traversal technique in JAR extraction is well-documented and straightforward to implement for anyone with the required access.