Executive brief
XWiki is a collaborative platform used for knowledge management and documentation. A security flaw in how the platform handles certain extensions could allow an administrator of a sub-section of the wiki to write malicious files to the server. This could lead to a full system takeover, including the ability to reset the master administrator password and modify critical configuration files.
Technical details
A path traversal vulnerability exists in the XWiki Platform WebJars API (org.xwiki.platform:xwiki-platform-webjars-api). The flaw occurs when the system processes WebJar extensions containing malicious path sequences (e.g., '../'). An attacker with administrative access to at least a subwiki can exploit this by installing a malicious extension from a configured repository and triggering an HTML export of a page referencing the malicious path. This allows for arbitrary file writes within the context of the XWiki temporary directory or potentially sensitive configuration locations. The vulnerability has been patched in versions 16.10.17, 17.4.9, 17.10.3, and 18.0.0RC1.
Affected products
- XWiki xwiki-platform-webjars-api >= 9.6-rc-1, < 16.10.17; >= 17.0.0-rc-1, < 17.4.9; >= 17.5.0-rc-1, < 17.10.3
Timeline
- 2026-01-15: other: Issue created in XWiki JIRA
- 2026-01-16: patched: Issue resolved in XWiki JIRA
- 2026-05-21: disclosed: Advisory published by vendor
- 2026-05-26: advisory: GitHub Advisory published