Executive brief
XWiki is an open-source enterprise wiki platform used for collaborative documentation and knowledge management. A security flaw allows unauthenticated attackers to access sensitive server configuration files by manipulating web addresses. This could lead to the exposure of administrative credentials or system secrets, potentially resulting in a full takeover of the wiki platform.
Technical details
A path traversal vulnerability exists in XWiki Platform's Skin Extension (SSX) and JavaScript Extension (JSX) endpoints. The root cause is insufficient validation of the 'resource' parameter when a leading slash is used, allowing an attacker to escape the intended directory. By sending a specially crafted HTTP request to endpoints like /bin/ssx/ or /bin/jsx/ with a manipulated resource path (e.g., using /../../ sequences), a remote, unauthenticated attacker can read arbitrary files on the server, such as xwiki.cfg. This issue is specifically reproducible on deployments using Apache Tomcat. Patches are available in versions 16.10.17, 17.4.9, 17.10.3, and 18.1.0-rc-1.
Affected products
- XWiki XWiki Platform >= 4.2-milestone-2, < 16.10.17; >= 17.0.0-rc-1, < 17.4.9; >= 17.5.0, < 17.10.3; >= 18.0.0-rc-1, < 18.1.0-rc-1
Timeline
- 2026-05-20: disclosed
- 2026-05-20: advisory
- 2026-05-26: other: GitHub Advisory reviewed