Is CVE-2026-48047 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-48047 being exploited in the wild.

How severe is CVE-2026-48047?

Medium severity, with a CVSS score of 4, published 7 August 2026.

Which products and versions are affected?

org.xwiki.platform:xwiki-platform-webjars-api (Maven) ECOSYSTEM:introduced=9.6-rc-1,fixed=16.10.17.

Is there a fix for CVE-2026-48047?

Yes. org.xwiki.platform:xwiki-platform-webjars-api (Maven): upgrade to 16.10.17 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-48047 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-48047?

Check whether you run org.xwiki.platform:xwiki-platform-webjars-api (Maven) or Xwiki Platform WebJars API at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-48047: XWiki Platform path traversal in WebJar API

CVE-2026-48047 · Severity: medium · CVSS 4 · Published 2026-08-07

XWiki is a collaborative platform used for knowledge management and documentation. A security flaw in how the platform handles certain extensions could allow an administrator of a sub-section of the wiki to write malicious files to the server. This could lead to a full system takeover, including the ability to reset the master administrator password and modify critical configuration files.

Vendors: Maven, Xwiki.

Quick answers

Is CVE-2026-48047 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-48047 being exploited in the wild.
How severe is CVE-2026-48047?: Medium severity, with a CVSS score of 4, published 7 August 2026.
Which products and versions are affected?: org.xwiki.platform:xwiki-platform-webjars-api (Maven) ECOSYSTEM:introduced=9.6-rc-1,fixed=16.10.17.
Is there a fix for CVE-2026-48047?: Yes. org.xwiki.platform:xwiki-platform-webjars-api (Maven): upgrade to 16.10.17 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-48047 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-48047?: Check whether you run org.xwiki.platform:xwiki-platform-webjars-api (Maven) or Xwiki Platform WebJars API at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

org.xwiki.platform:xwiki-platform-webjars-api (Maven): upgrade to 16.10.17 or later

# set org.xwiki.platform:xwiki-platform-webjars-api to 16.10.17 in your pom.xml or build.gradle

Technical details

A path traversal vulnerability exists in the XWiki Platform WebJars API (org.xwiki.platform:xwiki-platform-webjars-api). The flaw occurs when the system processes WebJar extensions containing malicious path sequences (e.g., '../'). An attacker with administrative access to at least a subwiki can exploit this by installing a malicious extension from a configured repository and triggering an HTML export of a page referencing the malicious path. This allows for arbitrary file writes within the context of the XWiki temporary directory or potentially sensitive configuration locations. The vulnerability has been patched in versions 16.10.17, 17.4.9, 17.10.3, and 18.0.0RC1.

Affected products

XWiki xwiki-platform-webjars-api >= 9.6-rc-1, < 16.10.17; >= 17.0.0-rc-1, < 17.4.9; >= 17.5.0-rc-1, < 17.10.3

Identifiers

CVE-2026-48047
GHSA-vgwr-23fq-pr7g

Timeline

2026-01-15: other: Issue created in XWiki JIRA
2026-01-16: patched: Issue resolved in XWiki JIRA
2026-05-21: disclosed: Advisory published by vendor
2026-05-26: advisory: GitHub Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.