# CVE-2026-23734: XWiki Platform path traversal in ssx and jsx endpoints

Source: https://junglewise.ai/threats/cve-2026-23734-xwiki-platform-path-traversal-in-ssx-and-jsx-endpoints  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-20. Updated: 2026-05-26  
License: CC BY 4.0 with a link back

CVE-2026-23734 · Severity: critical · CVSS 4 · Published 2026-05-20

XWiki is an open-source enterprise wiki platform used for collaborative documentation and knowledge management. A security flaw allows unauthenticated attackers to access sensitive server configuration files by manipulating web addresses. This could lead to the exposure of administrative credentials or system secrets, potentially resulting in a full takeover of the wiki platform.

Technologies: [Xwiki Platform](https://junglewise.ai/threats/technologies/platform). Vendors: [Maven](https://junglewise.ai/threats/vendors/maven), [Xwiki](https://junglewise.ai/threats/vendors/xwiki).

## Quick answers

**Is CVE-2026-23734 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-23734 being exploited in the wild.

**How severe is CVE-2026-23734?** Critical severity, with a CVSS score of 4, published 20 May 2026.

**Which products and versions are affected?** org.xwiki.commons:xwiki-commons-classloader-api (Maven) ECOSYSTEM:introduced=4.2-milestone-2,fixed=16.10.17; Xwiki Platform >= 4.2-milestone-2, < 16.10.17; >= 17.0.0-rc-1, < 17.4.9; >= 17.5.0, < 17.10.3; >= 18.0.0-rc-1, < 18.1.0-rc-1; XWiki Platform < 18.1.0-rc-1, < 17.10.3, < 17.4.9, < 16.10.17.

**Is there a fix for CVE-2026-23734?** Yes. org.xwiki.commons:xwiki-commons-classloader-api (Maven): upgrade to 16.10.17 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-23734 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-23734?** Check whether you run org.xwiki.commons:xwiki-commons-classloader-api (Maven), Xwiki Platform or XWiki Platform at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- org.xwiki.commons:xwiki-commons-classloader-api (Maven): upgrade to 16.10.17 or later

  ```sh
  # set org.xwiki.commons:xwiki-commons-classloader-api to 16.10.17 in your pom.xml or build.gradle
  ```


## Technical details

A path traversal vulnerability exists in XWiki Platform's Skin Extension (SSX) and JavaScript Extension (JSX) endpoints. The root cause is insufficient validation of the 'resource' parameter when a leading slash is used, allowing an attacker to escape the intended directory. By sending a specially crafted HTTP request to endpoints like /bin/ssx/ or /bin/jsx/ with a manipulated resource path (e.g., using /../../ sequences), a remote, unauthenticated attacker can read arbitrary files on the server, such as xwiki.cfg. This issue is specifically reproducible on deployments using Apache Tomcat. Patches are available in versions 16.10.17, 17.4.9, 17.10.3, and 18.1.0-rc-1.

## Affected products

- XWiki XWiki Platform >= 4.2-milestone-2, < 16.10.17; >= 17.0.0-rc-1, < 17.4.9; >= 17.5.0, < 17.10.3; >= 18.0.0-rc-1, < 18.1.0-rc-1

## Identifiers

- CVE-2026-23734
- GHSA-xq3r-2qv5-vqqm

## Timeline

- 2026-05-20: disclosed
- 2026-05-20: advisory
- 2026-05-26: other: GitHub Advisory reviewed

## References

- [https://api.github.com/users/majkelstick](https://api.github.com/users/majkelstick)
- [https://github.com/majkelstick](https://github.com/majkelstick)
- [https://api.github.com/users/majkelstick/gists%7B/gist_id%7D](https://api.github.com/users/majkelstick/gists%7B/gist_id%7D)
- [https://api.github.com/users/majkelstick/repos](https://api.github.com/users/majkelstick/repos)
- [https://avatars.githubusercontent.com/u/36599157?v=4](https://avatars.githubusercontent.com/u/36599157?v=4)
- [https://api.github.com/users/majkelstick/events%7B/privacy%7D](https://api.github.com/users/majkelstick/events%7B/privacy%7D)

## Related threats

- [XWiki Platform Live Data privilege escalation through edit API](https://junglewise.ai/threats/cve-2026-53966-xwiki-platform-live-data-privilege-escalation-through-edit-api)
- [XWiki Platform missing authorization in REST API XAR import](https://junglewise.ai/threats/cve-2026-33137-xwiki-platform-missing-authorization-in-rest-api-xar-import)
- [XWiki Platform sandbox bypass in Velocity scripting API](https://junglewise.ai/threats/cve-2026-33229-xwiki-platform-sandbox-bypass-in-velocity-scripting-api)
- [XWiki Platform eval injection in SolrSearch](https://junglewise.ai/threats/cve-2025-24893-xwiki-platform-eval-injection-in-solrsearch)
- [XWiki privilege escalation via link refactoring](https://junglewise.ai/threats/cve-2025-49580-xwiki-privilege-escalation-via-link-refactoring)