Is there a patch available for CVE-2026-48047?

Yes, a patch is available for CVE-2026-48047. Update the affected software to the latest version immediately.

XWiki Platform CVE-2026-48047

MEDIUM

Path Traversal: '../filedir' (CWE-24)

2026-05-26 https://github.com/xwiki/xwiki-platform

GHSA-vgwr-23fq-pr7g

Atlassian Path Traversal

Lifecycle Timeline

Source Code Evidence Fetched

Jun 08, 2026 - 12:10 vuln.today

Analysis Generated

Jun 08, 2026 - 12:10 vuln.today

DescriptionCVE.org

Impact

A potential path traversal vulnerability allow an attacker who manages to get a malicious WebJar extension installed on the wiki to write arbitrary files. While the consequences could be severe like overriding configuration files and setting the superadmin password, the attack first requires that the attacker already has admin access to at least a subwiki to be able to install a malicious extension. Further, the attacker needs to publish a malicious extension in an extension repository that is configured in the instance.

Patches

This vulnerability has been patched in XWiki 16.10.17, 17.4.9, 17.10.3, and 18.0.0RC1.

Workarounds

XWiki is not aware of any workarounds except for being careful whom developers grant script and admin rights to.

Resources

https://jira.xwiki.org/browse/XWIKI-23902
https://github.com/xwiki/xwiki-platform/commit/9f747fcd3200259a1de51957d3f5f6acc8e3816c

AnalysisAI

Path traversal in XWiki Platform's WebJars API enables a subwiki admin who can publish and install a malicious WebJar extension to write arbitrary files anywhere on the server filesystem. The affected Maven component xwiki-platform-webjars-api fails to validate that JAR entry paths extracted during extension installation remain within the intended export directory, allowing overwrite of configuration files or potential superadmin credential manipulation. No public exploit is identified and no CISA KEV listing exists; vendor-released patches are available across three version branches.

Technical ContextAI

The vulnerability (CWE-24: Path Traversal) resides in FilesystemResourceReferenceCopier.java within the Maven artifact pkg:maven/org.xwiki.platform:xwiki-platform-webjars-api. The copyResourceFromJAR method previously constructed a target File object by concatenating user-controlled JAR entry names with a base export directory path, without verifying the resolved canonical path remained within that directory. A maliciously crafted WebJar could embed entries using ../ sequences to escape the export directory boundary. The fix - commit 9f747fcd3200259a1de51957d3f5f6acc8e3816c - adds explicit canonical path containment checks: both the target location and the export directory are resolved via getCanonicalPath(), and a startsWith() guard ensures no write proceeds outside the export directory. CSS resource resolution in processCSSfile received an analogous prefix-boundary check.

RemediationAI

Upgrade XWiki Platform to a patched release: 16.10.17 for the 16.x LTS branch, 17.4.9 for the 17.4.x branch, 17.10.3 for the 17.10.x branch, or 18.0.0RC1 and later. The upstream code fix is available at https://github.com/xwiki/xwiki-platform/commit/9f747fcd3200259a1de51957d3f5f6acc8e3816c. The vendor explicitly states no technical workarounds are known beyond carefully auditing who is granted script and admin rights. As a compensating control for instances that cannot immediately upgrade, administrators should audit and restrict which external extension repositories are configured in the instance - removing untrusted or unnecessary repositories reduces the pathway for a malicious extension to be published and installed, though this does not eliminate the vulnerability and limits legitimate extension availability. Additionally, reviewing and tightening subwiki admin role assignments to only fully trusted internal users is the most effective risk reduction short of patching.