{"id":"CVE-2026-34151","summary":"XWiki Platform: Resource path traversal via /skin/ action endpoint in Jetty 12+","details":"XWiki Platform is a generic wiki platform. Prior to 17.10.5 and 18.2.0, the /skin/ action in com.xpn.xwiki.web.SkinAction can resolve double-encoded parent-directory segments outside the intended skin or web-application resource prefix when Jetty 12 or later decodes the request path. The affected lookup is replaced with Environment.getResourceAsStream(String, String), which constrains a resource to its expected prefix. An unauthenticated remote attacker can use the vulnerable behavior to read arbitrary resources permitted to the Jetty process, including WEB-INF/xwiki.cfg and, depending on deployment depth and operating-system permissions, host files. Tomcat and Jetty versions before 12 do not appear affected. This issue is fixed in versions 17.10.5 and 18.2.0.","aliases":["GHSA-qj4x-9g63-25g6"],"modified":"2026-09-16T08:11:35.178617Z","published":"2026-09-14T17:12:18.814Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-24"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34151.json"},"references":[{"type":"WEB","url":"https://github.com/xwiki/xwiki-platform/releases/tag/xwiki-platform-17.10.5"},{"type":"WEB","url":"https://github.com/xwiki/xwiki-platform/releases/tag/xwiki-platform-18.2.0"},{"type":"WEB","url":"https://jira.xwiki.org/browse/XCOMMONS-3594"},{"type":"WEB","url":"https://jira.xwiki.org/browse/XWIKI-24075"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34151.json"},{"type":"ADVISORY","url":"https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-qj4x-9g63-25g6"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34151"},{"type":"FIX","url":"https://github.com/xwiki/xwiki-commons/pull/1675"},{"type":"FIX","url":"https://github.com/xwiki/xwiki-platform/commit/79eba8655f3a96021a8e7ad07956e48d20a82383"},{"type":"FIX","url":"https://github.com/xwiki/xwiki-platform/commit/f7b33704083d3b4e45d1b9fc1e2cc33c66855f85"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/xwiki/xwiki-commons","events":[{"introduced":"0"},{"fixed":"2d7521e419f12af58cf680a34df635bc00a6f621"},{"introduced":"c867b3899680bc320d9c834ff2e1f4e061989491"},{"fixed":"2b5388e7e7c591476ca3a9aebd9397703e9bc355"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"17.10.5"},{"introduced":"18.0.0-rc-1"},{"fixed":"18.2.0"}],"source":"AFFECTED_FIELD"}},{"type":"GIT","repo":"https://github.com/xwiki/xwiki-platform","events":[{"introduced":"0"},{"fixed":"79eba8655f3a96021a8e7ad07956e48d20a82383"},{"fixed":"f7b33704083d3b4e45d1b9fc1e2cc33c66855f85"},{"fixed":"429bcd1dbf184b95cf38253225568c111220431e"},{"fixed":"1592ba8e7a5b521d24af0ce80f505b31271aace1"}],"database_specific":{"source":"REFERENCES"}}],"versions":["xwiki-commons-18.2.0-rc-1","xwiki-commons-17.10.4","xwiki-commons-17.10.3","xwiki-commons-17.10.2","xwiki-commons-17.10.1","xwiki-commons-17.10.0","xwiki-commons-17.10.0-rc-1","xwiki-commons-8.3-milestone-2","xwiki-commons-8.3-milestone-1","xwiki-commons-8.2-milestone-2","xwiki-commons-8.2-milestone-1","xwiki-commons-8.1-milestone-2","xwiki-commons-8.1-milestone-1","xwiki-commons-8.0-milestone-2","xwiki-commons-8.0-milestone-1","xwiki-platform-18.2.0-rc-1","xwiki-platform-17.10.4","xwiki-platform-17.10.3","xwiki-platform-17.10.2","xwiki-platform-17.10.1","xwiki-platform-17.10.0","xwiki-platform-17.10.0-rc-1","xwiki-platform-9.9-rc-2","xwiki-platform-8.3-milestone-1","xwiki-platform-8.2-milestone-2","xwiki-platform-8.2-milestone-1","xwiki-platform-8.1-milestone-2","xwiki-platform-8.1-milestone-1","xwiki-platform-8.0-milestone-2","xwiki-platform-8.0-milestone-1","xwiki-platform-7.4-milestone-2","xwiki-platform-7.4-milestone-1","xwiki-platform-7.3-milestone-2"],"database_specific":{"vanir_signatures":[{"digest":{"line_hashes":["300521186603654054403607624646777299346","70389864451945792318823681564078851953","204654976240122846852865188765407183980","106161539821157325003819756249043849365","109073689258820863673638585271664081581","217965722379163487871040476901245775395","227691344010066131540920899797210075142","133314460298347672437681425612969919825","123609781873462907174932036995444124480","101047779524773154082376535404430548369"],"threshold":0.9},"id":"CVE-2026-34151-01b0c206","signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/f7b33704083d3b4e45d1b9fc1e2cc33c66855f85","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/test/java/com/xpn/xwiki/internal/skin/ClassLoaderSkinTest.java"},"deprecated":false},{"id":"CVE-2026-34151-04c32658","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/f7b33704083d3b4e45d1b9fc1e2cc33c66855f85","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/internal/skin/AbstractResourceSkin.java","function":"getProperties"},"deprecated":false,"digest":{"function_hash":"129722177448896361957437634277803763174","length":510}},{"target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/internal/skin/EnvironmentSkin.java","function":"exists"},"deprecated":false,"digest":{"length":65,"function_hash":"106495756020413414240404709127764884090"},"id":"CVE-2026-34151-0798d89c","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/f7b33704083d3b4e45d1b9fc1e2cc33c66855f85"},{"source":"https://github.com/xwiki/xwiki-platform/commit/79eba8655f3a96021a8e7ad07956e48d20a82383","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/test/java/com/xpn/xwiki/internal/skin/ClassLoaderSkinTest.java","function":"getLocalResourceWithBreakInAttempt"},"deprecated":false,"digest":{"function_hash":"185379718819842883012376793906795390131","length":263},"id":"CVE-2026-34151-087062ef","signature_type":"Function","signature_version":"v1"},{"id":"CVE-2026-34151-0d4c9953","signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/79eba8655f3a96021a8e7ad07956e48d20a82383","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/web/SkinAction.java"},"deprecated":false,"digest":{"line_hashes":["1708981451728759500492230160571269143","142809901267590795269555746069304089543","266452070502211593962940805680741244357","184250517597799912755658942518725749876","336804459762039680564190428650759571267","59840424872070193699232362125762204186","43174671653522477052796442275201736663","245202906349739459916012699337508958582","99366870016859131360401694338879143169","290436475891955245534602628371599821610","211224974141150846134734095584879018585","252419016774299833536461199493810711211","2456392217172737418316234847085079088","20665876416979880057472600252286964774","128754379125280579825274090719799315713","21102866848212310551152856525519622600","215216981794180964613784346368415332272","171659343304570559832731530593753286626","264114618892331406912694850455207256755","212422986188536283938485909438103727499","229881089545525128609513054803793022292","37685542541009928423447540252806687242","269008279522632827943155341522511461572","310554649850553660421773631047656661487","339442670189480165734226679556792367588","326631501190171567044614571023413829991","333543214288596390378759938763561679323","26319756738078811300152578613848450220","215392117247148702478444654207515554077","70547103978284137318390495007922184687","176240895928265973611786752541171003346","246752467675085667256284005480199357473","227906099371494251141134680432318297185","129123470732489267521761293908444671913","244014930218600674403579314795206426843","77219655724761519013498702639221367405","146024727901452134166842030726831311190","138684815398455315649885833105669355402","196894553385553093450061585174210691942","42996902673084130769781839532366510061","56533730603136614320857317502307433173","40462647491547655062553316020205978834","218779190987555089104871713670936214304","12889119000676242805550803674416141850","232537703277255618307403497960293739455","284333546308177692495704245210600243824","227967499945234236109970091487623670825","283050159727038367895616661317974620575","157854754989399883964114212789640430359","220932158682250309802149410123580805021","215854452606490200159736493980331831930","231055165525807555109041244344839498120","235790705485014497131029718150980735979","189408023315780942002743201454353943463","81977005151415762026634357620890745346","103347184995735792784900702655747178030","203668133176774541606999725311845907766","328691765888299564618428420985361133702","9659819351237631619262951274510251908","77746378049776433738538624544533608957","231594836688396542539924353268304392222","278546354210387345777377030527788942301","190992631459046322075257744293718877253","171717654259647541916781364932598683748","155887895952096999587935629667455316081","144425124351529884466488123059432965939","61145061955992709797476100350990815823","72799334614033710092564894072534103411","193781618807478461261622777664046880107","201676794073620956698199935924356196740","223523554595413854622113914348853060082","305725640803415932585099562188342394066","322657178734817816968692631592247321748","32870366443065488380234305629456891102","10374950035267249977156131113220593158","129552227424437589828974996230175190843","193471218846301918036864870250389630417","39668557147274345574190088407086142745","215794757067599343850197224474223434490","28477646983097039529074695879522334570","65839109840063548284027107225946107814","272562865793739689068560909898389367566","243795794373095561665237813711360611803","46282841541201214489387124153742483459","23896935382642224565513526216731783860","230253085513449358086331874232512909875","254256356641476880875125646058830542720","297939358410573826227688770307535211552","286764190855819657996170375297746999345","59436134180042025317344671079283563808","277180082238761138815882684564406472491","287622350520045069130185497553760690973","267997950970875916256954920662118518385","90229189733516454708752691500377878621","147931307234854056452098028390051330076"],"threshold":0.9}},{"digest":{"function_hash":"112572029261944283002095390190901301942","length":83},"id":"CVE-2026-34151-0e8663c7","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/f7b33704083d3b4e45d1b9fc1e2cc33c66855f85","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/internal/skin/EnvironmentSkin.java","function":"getResourceURL"},"deprecated":false},{"deprecated":false,"digest":{"line_hashes":["235190175480106620334295976597979215331","302740459371187849698386808867157376419","62827832118433580762453979094030356877","113723315751737386631070785169694314438","194412801173949947699688108246807793307","232675833411256460770738647862497150572","177147229899459879911043214054951978480","292118809114629268034555588553423565808","219239924458430763431124422674179490357","329932225049063915511160713968766202332","299891488640577396534227809853070747216","28963974413348082843648827781833786237","57634262111760689803423628524145756751"],"threshold":0.9},"id":"CVE-2026-34151-0f1ed656","signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/79eba8655f3a96021a8e7ad07956e48d20a82383","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/test/java/com/xpn/xwiki/test/AbstractBridgedComponentTestCase.java"}},{"deprecated":false,"digest":{"length":286,"function_hash":"74304154703462254701507054662707654660"},"id":"CVE-2026-34151-1037a78e","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/79eba8655f3a96021a8e7ad07956e48d20a82383","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/internal/template/InternalTemplateManager.java","function":"initialize"}},{"source":"https://github.com/xwiki/xwiki-platform/commit/f7b33704083d3b4e45d1b9fc1e2cc33c66855f85","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/internal/template/InternalTemplateManager.java","function":"getFileSystemTemplate"},"deprecated":false,"digest":{"function_hash":"199997750754219580867282023974914157336","length":541},"id":"CVE-2026-34151-12989f7c","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"line_hashes":["64829931007902739270737032190206717260","306701336123459997047636311303543284839","133641140859348906772827518495313597630","299116414072824112348207728019658306905","5152219564388862535672049220602020503","137763263822974961212197921343116804395","259318370235987005809301028823586196591","245647036906987330148606478072278542979","222169732212157056209394564964188650037","275090703068363085138381827241878466405","150233789943078320741906891366655647059","227390059743639935945870903870881663387","103627385648775785323205670573384829944","319477850581091157019191054875761322697","284774354655697963438523956429980611459","182428623866614722792829242499344369701","33890409434483601449512428784799660752","160637619944718272046770764906280703942","89966030583945563862012545723513488221","180649478633199969771617541041476597138","124116400054528853131254565409895673813","264052389015465017579846711667809460879","294538652730384745842494604632538671838","200388730513030634715960990776209355597","330766215783492842006617896938040752347","130913513363065899595981050087503565493","80193720626049397795564737089516347544","191577750846048893310420608124800375098","102522916776703784363112710388629684831","2921726848869011180691041639991479746","159953729594859139046951974653221303946","42051051167959029836891487437367616901","145504907135679892999231721630548882731","237280300993772916533353441932939690263","303264583947196160105710140209876743634","206618481538622450500265916360073807638","225891098860292948521010488914897196410","318734402637867392784554728141587792715","151294525547817470097093901928759307728","335391923332883398951730313256478179123","201813785989310512801353197422550506197","63023319149774050960125992398873200987","69349446291585749390597458145774047831","133930823083195803866133400081321943040","22557479717946682599169899470212483752","306871616209780322617165099908737646402","278867883783892739054663752480520240785","156220754693425221508199242700430553486","161449640809119437599610149379721085327","177166899179645215363161412587299798591","277549147786040965686235080429303019509","337537468189236378849484618456133968067"],"threshold":0.9},"id":"CVE-2026-34151-1835a14e","signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/f7b33704083d3b4e45d1b9fc1e2cc33c66855f85","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/internal/template/InternalTemplateManager.java"}},{"target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/web/SkinAction.java","function":"renderFileFromObjectField"},"deprecated":false,"digest":{"function_hash":"38952948259807338067625441603659548653","length":913},"id":"CVE-2026-34151-199c9330","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/f7b33704083d3b4e45d1b9fc1e2cc33c66855f85"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/79eba8655f3a96021a8e7ad07956e48d20a82383","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/test/java/com/xpn/xwiki/internal/template/TemplateManagerTest.java","function":"templateCheatingProtection"},"deprecated":false,"digest":{"function_hash":"212856357623680545125281072383888902777","length":417},"id":"CVE-2026-34151-1ad76342"},{"target":{"function":"getFileSystemTemplate","file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/internal/template/InternalTemplateManager.java"},"deprecated":false,"digest":{"function_hash":"199997750754219580867282023974914157336","length":541},"id":"CVE-2026-34151-1f8ec1be","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/79eba8655f3a96021a8e7ad07956e48d20a82383"},{"source":"https://github.com/xwiki/xwiki-platform/commit/f7b33704083d3b4e45d1b9fc1e2cc33c66855f85","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/internal/skin/AbstractResourceSkin.java","function":"getPropertiesPath"},"deprecated":false,"digest":{"function_hash":"136284510593604619709198075836803453630","length":64},"id":"CVE-2026-34151-217e05af","signature_type":"Function","signature_version":"v1"},{"target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/test/java/com/xpn/xwiki/internal/skin/EnvironmentSkinTest.java","function":"getLocalResource"},"deprecated":false,"digest":{"function_hash":"14115547634009100359801165904325538643","length":304},"id":"CVE-2026-34151-251531aa","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/f7b33704083d3b4e45d1b9fc1e2cc33c66855f85"},{"deprecated":false,"digest":{"function_hash":"224664230059187654820582641509381714291","length":785},"id":"CVE-2026-34151-28223e0a","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/79eba8655f3a96021a8e7ad07956e48d20a82383","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/web/SkinAction.java","function":"renderSkin"}},{"deprecated":false,"digest":{"line_hashes":["226070442915859056458846484365413200011","59647514661405636585921352104952073245","279150308520409100197936788936349406269","306443693155140493489402156164952149539","264760437296082081296436351806190936664","277159735920837145691687500143140001041","147577188154742093406584898346328360291","233065712343806096733768340213902271143","40734465467478765868150560593768920658","326579689214148238487536568201193915427","85217217482252704030107928144967034280","252244879111143683289297936469116224941"],"threshold":0.9},"id":"CVE-2026-34151-2c9a67dd","signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/f7b33704083d3b4e45d1b9fc1e2cc33c66855f85","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/internal/skin/EnvironmentSkin.java"}},{"target":{"function":"renderFileFromObjectField","file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/web/SkinAction.java"},"deprecated":false,"digest":{"length":913,"function_hash":"38952948259807338067625441603659548653"},"id":"CVE-2026-34151-2ce87250","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/79eba8655f3a96021a8e7ad07956e48d20a82383"},{"digest":{"function_hash":"294751141044601334356986959168096267316","length":269},"id":"CVE-2026-34151-2d450a29","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/f7b33704083d3b4e45d1b9fc1e2cc33c66855f85","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/test/java/com/xpn/xwiki/internal/skin/EnvironmentSkinTest.java","function":"exists"},"deprecated":false},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/f7b33704083d3b4e45d1b9fc1e2cc33c66855f85","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/XWiki.java","function":"getResourceAsStream"},"deprecated":false,"digest":{"length":195,"function_hash":"135215182499297217549185794958926321617"},"id":"CVE-2026-34151-337a0c77"},{"signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/f7b33704083d3b4e45d1b9fc1e2cc33c66855f85","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/web/SkinAction.java","function":"renderSkin"},"deprecated":false,"digest":{"function_hash":"224664230059187654820582641509381714291","length":785},"id":"CVE-2026-34151-33d1f9e6","signature_type":"Function"},{"deprecated":false,"digest":{"length":83,"function_hash":"244086501114628382524974969153206499270"},"id":"CVE-2026-34151-3402c9bb","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/f7b33704083d3b4e45d1b9fc1e2cc33c66855f85","target":{"function":"getResourceURL","file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/internal/skin/ClassLoaderSkin.java"}},{"digest":{"line_hashes":["300023242287296562946270999440600501727","205689060994887426175258169171366474540","48063525958231952781156876406904714076","321033700292710485690865172871440628701","84434389110368791112994202998952648006","162703141963788702126665073277977561105","54281887107859944020791689944515339559","195586635159184554823235715326101967761","238849817567485133057248939038363796166","101022868312908172924744852844944814090","224173643329666920416634750357724001415","27059894842636450773008934703656779527","275055707271463998027461129336785447234","43447954388661335263541786789771352929","251953042051781736229496294634284174704","172131274810906733492832144201793452826","63337146033139330032195839751667213605","14863974872952286060363582497945006682","221739535146392039114583102891612114608","175681045256479319277260050269517323676","93978662232035162914247102804306877650","277748075713881927204555862786054476300"],"threshold":0.9},"id":"CVE-2026-34151-36a0a858","signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/79eba8655f3a96021a8e7ad07956e48d20a82383","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/XWiki.java"},"deprecated":false},{"source":"https://github.com/xwiki/xwiki-platform/commit/79eba8655f3a96021a8e7ad07956e48d20a82383","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/internal/skin/EnvironmentSkin.java","function":"getResourceURL"},"deprecated":false,"digest":{"function_hash":"112572029261944283002095390190901301942","length":83},"id":"CVE-2026-34151-38214e83","signature_type":"Function","signature_version":"v1"},{"target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/web/SkinAction.java","function":"getSkinFilePath"},"deprecated":false,"digest":{"function_hash":"189157914933247243235337886495742684941","length":463},"id":"CVE-2026-34151-3b25a0e9","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/79eba8655f3a96021a8e7ad07956e48d20a82383"},{"signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/79eba8655f3a96021a8e7ad07956e48d20a82383","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/internal/skin/AbstractResourceSkin.java","function":"getSkinResourcePath"},"deprecated":false,"digest":{"function_hash":"163829157298260825528746816133429025439","length":304},"id":"CVE-2026-34151-3be884f4","signature_type":"Function"},{"source":"https://github.com/xwiki/xwiki-platform/commit/f7b33704083d3b4e45d1b9fc1e2cc33c66855f85","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/web/SkinAction.java","function":"getResourceFilePath"},"deprecated":false,"digest":{"length":416,"function_hash":"137537167486467264891427567654684019143"},"id":"CVE-2026-34151-3f6dc07f","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"149666728676381987437667999734624377013","length":626},"id":"CVE-2026-34151-40ebbafa","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/79eba8655f3a96021a8e7ad07956e48d20a82383","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/test/java/com/xpn/xwiki/internal/skin/InternalSkinManagerTest.java","function":"getSkinCreateClassLoaderWiki"}},{"deprecated":false,"digest":{"function_hash":"136284510593604619709198075836803453630","length":64},"id":"CVE-2026-34151-4722c4de","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/79eba8655f3a96021a8e7ad07956e48d20a82383","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/internal/skin/AbstractResourceSkin.java","function":"getPropertiesPath"}},{"target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/web/SkinAction.java","function":"getSkinFilePath"},"deprecated":false,"digest":{"function_hash":"189157914933247243235337886495742684941","length":463},"id":"CVE-2026-34151-49e5af8e","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/f7b33704083d3b4e45d1b9fc1e2cc33c66855f85"},{"deprecated":false,"digest":{"function_hash":"103709658315511026189371917160391799167","length":986},"id":"CVE-2026-34151-4a3e7d33","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/79eba8655f3a96021a8e7ad07956e48d20a82383","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/web/SkinAction.java","function":"renderFileFromAttachment"}},{"id":"CVE-2026-34151-4b03a8ca","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/79eba8655f3a96021a8e7ad07956e48d20a82383","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/internal/skin/ClassLoaderSkin.java","function":"getResourceURL"},"deprecated":false,"digest":{"function_hash":"244086501114628382524974969153206499270","length":83}},{"deprecated":false,"digest":{"function_hash":"5939226520039135681313115020897886586","length":166},"id":"CVE-2026-34151-4b7534b0","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/79eba8655f3a96021a8e7ad07956e48d20a82383","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/internal/skin/AbstractResourceSkin.java","function":"getLocalResource"}},{"digest":{"line_hashes":["142074888839739170541232213876977035427","327074528641518854530266914777372152856","335986534415102149130606713770854567690","76502279661932985033582416630159513656","161830793145210615100902758588910871703","291095689416155500204101310173516795390","264962045167373400864741637912991726682","140775772346736594049315071683849645833","285074399939434780332668485681641865110","164466927620930388016406281483205767618","54210663319430935896492536214337928725","332993134774425677597241997788804400288","50421212407939384802532179045658762341","44705270043113546283035903892838603512","149588690454193147062176169779128730130","148044977439898291406745755550851290856","211694727181267924882190934742644970876","266674967085826781964943549664317653261","200450353244946862921384835785685812783","219090563672791696814481105118888075687","64646017531501352923217224734850881661","112419305447059016605326638051600768480","102572734138992820377061469554755201831","67413620121831660795484392002303796323","13512533735871857915243971610658153967","145963406291574618646425851945579089579","152293769254674474484304621037279269508","210027187161391254558233870508799946805","204190986514962853558181754259023699864","234244074825237889108633449272842840306","185069496473877559423279326203122154110","396566652011590193544784542210753870","91324312229271628116429526546676388072","83549708687484495734586093876807974970","252117913014726466809137827758823822206","103855412457694787076917395569151471136","175291003262625270933647496218268505848","203891894339652230964727682998902680504","169513149005427662867885778436754864534","119701848822680988984852956919007611827","117492513071110519189373016622557042384","221289872850157775874006882723951845663","321548997062803730278963541078318307289","7790851865976559626202102975683671700","197167865876226007645004008517805833084","110742074119049836297593074559432849007","290274022856604315799748300450335237342","31151696193857685744832720079051652303","322204464759963389042651107439257348742","331174725257236017418981050286295733469","203937333109071130352817706036495980208","217113299700739887282843246842475060405","5341195671021808314631981515801929693","5721011630944325656506387461642741700"],"threshold":0.9},"id":"CVE-2026-34151-4d78022f","signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/79eba8655f3a96021a8e7ad07956e48d20a82383","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/internal/skin/AbstractResourceSkin.java"},"deprecated":false},{"deprecated":false,"digest":{"line_hashes":["170225729222046311510180943213928367036","265176597144264959237390245834683278558"],"threshold":0.9},"id":"CVE-2026-34151-506c54a2","signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/79eba8655f3a96021a8e7ad07956e48d20a82383","target":{"file":"xwiki-platform-core/xwiki-platform-flamingo/xwiki-platform-flamingo-skin/xwiki-platform-flamingo-skin-test/xwiki-platform-flamingo-skin-test-docker/src/test/it/org/xwiki/flamingo/test/docker/AllIT.java"}},{"deprecated":false,"digest":{"length":1258,"function_hash":"16772595621620743662200847589994027964"},"id":"CVE-2026-34151-5354848d","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/79eba8655f3a96021a8e7ad07956e48d20a82383","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/test/java/com/xpn/xwiki/test/AbstractBridgedComponentTestCase.java","function":"setUp"}},{"signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/79eba8655f3a96021a8e7ad07956e48d20a82383","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/internal/skin/EnvironmentSkin.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["226070442915859056458846484365413200011","59647514661405636585921352104952073245","279150308520409100197936788936349406269","306443693155140493489402156164952149539","264760437296082081296436351806190936664","277159735920837145691687500143140001041","147577188154742093406584898346328360291","233065712343806096733768340213902271143","40734465467478765868150560593768920658","326579689214148238487536568201193915427","85217217482252704030107928144967034280","252244879111143683289297936469116224941"]},"id":"CVE-2026-34151-53f15f6a","signature_type":"Line"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/f7b33704083d3b4e45d1b9fc1e2cc33c66855f85","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/XWiki.java"},"deprecated":false,"digest":{"line_hashes":["300023242287296562946270999440600501727","205689060994887426175258169171366474540","48063525958231952781156876406904714076","321033700292710485690865172871440628701","84434389110368791112994202998952648006","162703141963788702126665073277977561105","54281887107859944020791689944515339559","195586635159184554823235715326101967761","238849817567485133057248939038363796166","101022868312908172924744852844944814090","224173643329666920416634750357724001415","27059894842636450773008934703656779527","275055707271463998027461129336785447234","43447954388661335263541786789771352929","251953042051781736229496294634284174704","172131274810906733492832144201793452826","63337146033139330032195839751667213605","14863974872952286060363582497945006682","221739535146392039114583102891612114608","175681045256479319277260050269517323676","93978662232035162914247102804306877650","277748075713881927204555862786054476300"],"threshold":0.9},"id":"CVE-2026-34151-588352d2"},{"deprecated":false,"digest":{"length":238,"function_hash":"157925564443495990681451368758478179744"},"id":"CVE-2026-34151-5ac6530c","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/79eba8655f3a96021a8e7ad07956e48d20a82383","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/internal/template/InternalTemplateManager.java","function":"getTemplateRootPath"}},{"target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/test/java/com/xpn/xwiki/internal/template/TemplateManagerTest.java","function":"setTemplateContent"},"deprecated":false,"digest":{"function_hash":"51907732804525157120326706627306587693","length":364},"id":"CVE-2026-34151-5f02840f","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/f7b33704083d3b4e45d1b9fc1e2cc33c66855f85"},{"deprecated":false,"digest":{"function_hash":"186487606896186402091649445831535606354","length":1427},"id":"CVE-2026-34151-5fc3e5e7","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/79eba8655f3a96021a8e7ad07956e48d20a82383","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/web/SkinAction.java","function":"renderFileFromFilesystem"}},{"id":"CVE-2026-34151-6024eb08","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/f7b33704083d3b4e45d1b9fc1e2cc33c66855f85","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/test/java/com/xpn/xwiki/internal/skin/InternalSkinManagerTest.java","function":"getSkinCreateClassLoaderWiki"},"deprecated":false,"digest":{"function_hash":"149666728676381987437667999734624377013","length":626}},{"deprecated":false,"digest":{"line_hashes":["78000442994448159590155954623853709487","235875755039387923254904131153819034167","124452133435048639605850144392464995720","85902593647585579543958965141678906858","220501905699858577119439395267464780271","176128704048733173273073272248164109009","95498359009023582018762030746580421671","252524101829924438326450502405920046574","236488403619014249870582280165239891883","166663699944717887157108920015638756172","63594335616611318037526247020192484273","7968086269558929138461969524490425804","91716380383596577434798521600729342911","29267201724934462310427511995797490087","3254110841940356135055905060190061576","136410947894291515967932610243496045740","309799962743369422407715198869549289458","60736398006401068193484407686705493475"],"threshold":0.9},"id":"CVE-2026-34151-608f91a4","signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/79eba8655f3a96021a8e7ad07956e48d20a82383","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/test/java/com/xpn/xwiki/internal/template/TemplateManagerTest.java"}},{"id":"CVE-2026-34151-649c2e6e","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/79eba8655f3a96021a8e7ad07956e48d20a82383","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/web/SkinAction.java","function":"getResourceFilePath"},"deprecated":false,"digest":{"function_hash":"137537167486467264891427567654684019143","length":416}},{"signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/f7b33704083d3b4e45d1b9fc1e2cc33c66855f85","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/web/SkinAction.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["1708981451728759500492230160571269143","142809901267590795269555746069304089543","266452070502211593962940805680741244357","184250517597799912755658942518725749876","336804459762039680564190428650759571267","59840424872070193699232362125762204186","43174671653522477052796442275201736663","245202906349739459916012699337508958582","99366870016859131360401694338879143169","290436475891955245534602628371599821610","211224974141150846134734095584879018585","252419016774299833536461199493810711211","2456392217172737418316234847085079088","20665876416979880057472600252286964774","128754379125280579825274090719799315713","21102866848212310551152856525519622600","215216981794180964613784346368415332272","171659343304570559832731530593753286626","264114618892331406912694850455207256755","212422986188536283938485909438103727499","229881089545525128609513054803793022292","37685542541009928423447540252806687242","269008279522632827943155341522511461572","310554649850553660421773631047656661487","339442670189480165734226679556792367588","326631501190171567044614571023413829991","333543214288596390378759938763561679323","26319756738078811300152578613848450220","215392117247148702478444654207515554077","70547103978284137318390495007922184687","176240895928265973611786752541171003346","246752467675085667256284005480199357473","227906099371494251141134680432318297185","129123470732489267521761293908444671913","244014930218600674403579314795206426843","77219655724761519013498702639221367405","146024727901452134166842030726831311190","138684815398455315649885833105669355402","196894553385553093450061585174210691942","42996902673084130769781839532366510061","56533730603136614320857317502307433173","40462647491547655062553316020205978834","218779190987555089104871713670936214304","12889119000676242805550803674416141850","232537703277255618307403497960293739455","284333546308177692495704245210600243824","227967499945234236109970091487623670825","283050159727038367895616661317974620575","157854754989399883964114212789640430359","220932158682250309802149410123580805021","215854452606490200159736493980331831930","231055165525807555109041244344839498120","235790705485014497131029718150980735979","189408023315780942002743201454353943463","81977005151415762026634357620890745346","103347184995735792784900702655747178030","203668133176774541606999725311845907766","328691765888299564618428420985361133702","9659819351237631619262951274510251908","77746378049776433738538624544533608957","231594836688396542539924353268304392222","278546354210387345777377030527788942301","190992631459046322075257744293718877253","171717654259647541916781364932598683748","155887895952096999587935629667455316081","144425124351529884466488123059432965939","61145061955992709797476100350990815823","72799334614033710092564894072534103411","193781618807478461261622777664046880107","201676794073620956698199935924356196740","223523554595413854622113914348853060082","305725640803415932585099562188342394066","322657178734817816968692631592247321748","32870366443065488380234305629456891102","10374950035267249977156131113220593158","129552227424437589828974996230175190843","193471218846301918036864870250389630417","39668557147274345574190088407086142745","215794757067599343850197224474223434490","28477646983097039529074695879522334570","65839109840063548284027107225946107814","272562865793739689068560909898389367566","243795794373095561665237813711360611803","46282841541201214489387124153742483459","23896935382642224565513526216731783860","230253085513449358086331874232512909875","254256356641476880875125646058830542720","297939358410573826227688770307535211552","286764190855819657996170375297746999345","59436134180042025317344671079283563808","277180082238761138815882684564406472491","287622350520045069130185497553760690973","267997950970875916256954920662118518385","90229189733516454708752691500377878621","147931307234854056452098028390051330076"]},"id":"CVE-2026-34151-64d40b71","signature_type":"Line"},{"digest":{"function_hash":"51907732804525157120326706627306587693","length":364},"id":"CVE-2026-34151-746b7257","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/79eba8655f3a96021a8e7ad07956e48d20a82383","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/test/java/com/xpn/xwiki/internal/template/TemplateManagerTest.java","function":"setTemplateContent"},"deprecated":false},{"digest":{"function_hash":"185379718819842883012376793906795390131","length":263},"id":"CVE-2026-34151-7c29bd3f","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/f7b33704083d3b4e45d1b9fc1e2cc33c66855f85","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/test/java/com/xpn/xwiki/internal/skin/ClassLoaderSkinTest.java","function":"getLocalResourceWithBreakInAttempt"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"14115547634009100359801165904325538643","length":304},"id":"CVE-2026-34151-7d7a72c6","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/79eba8655f3a96021a8e7ad07956e48d20a82383","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/test/java/com/xpn/xwiki/internal/skin/EnvironmentSkinTest.java","function":"getLocalResource"}},{"id":"CVE-2026-34151-80a5478f","signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/79eba8655f3a96021a8e7ad07956e48d20a82383","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/test/java/com/xpn/xwiki/internal/skin/EnvironmentSkinTest.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["39153963575455003856166799721546454737","13406889127457890779057794123057300182","11281339921519961993417130076430359028","274264383843890629800415414773645410214","82094922024279383640580757101386010936","317723142256848157392057553537090990302","338748643960202198461479371936901802547","317591639040604650992743551802791388851","259685359370789380647277155723376597646","33110292319946403558523324604541033154","219623208282124831069962783334154667739","301756234763224144866092713629553365308","262706647306754625771663724058691242300","242269301427734209915126436749729921179","30320088005138858496038914019998787068","48900532427417365837625409825330253007","194489338868556575611066766770124075852","119863160373795269050115359426819730786","228033805053070037070245152389571187163","300725035250146346474081631279353761944","221249476999098535017556140698718656762","258907920338515376128263309512605933174"]}},{"id":"CVE-2026-34151-85c17da0","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/79eba8655f3a96021a8e7ad07956e48d20a82383","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/internal/template/InternalTemplateManager.java","function":"checkFilesystemTemplate"},"deprecated":false,"digest":{"function_hash":"165073290140579362649561968287276786302","length":425}},{"source":"https://github.com/xwiki/xwiki-platform/commit/f7b33704083d3b4e45d1b9fc1e2cc33c66855f85","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/test/java/com/xpn/xwiki/internal/template/TemplateManagerTest.java","function":"before"},"deprecated":false,"digest":{"length":388,"function_hash":"130565775866358379972010694764650440969"},"id":"CVE-2026-34151-87a73d3d","signature_type":"Function","signature_version":"v1"},{"id":"CVE-2026-34151-914eb305","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/79eba8655f3a96021a8e7ad07956e48d20a82383","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/test/java/com/xpn/xwiki/internal/skin/EnvironmentSkinTest.java","function":"getLocalResourceWithBreakInAttempt"},"deprecated":false,"digest":{"function_hash":"186839476894508223552600459533284152722","length":210}},{"target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/test/java/com/xpn/xwiki/internal/skin/InternalSkinManagerTest.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["113526046620326743688481245556018818184","282708677859948887296011121094732026216","275403056217916293210168318840949272370","108354154064706869867574378801370401830","257088331053072191302690906151580254703","319334552476938239468907394582426995508","187961616637571630093957532291548185742","19475756381353058678328139151560016577"]},"id":"CVE-2026-34151-94b239ae","signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/f7b33704083d3b4e45d1b9fc1e2cc33c66855f85"},{"source":"https://github.com/xwiki/xwiki-platform/commit/79eba8655f3a96021a8e7ad07956e48d20a82383","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/web/SkinAction.java","function":"render"},"deprecated":false,"digest":{"function_hash":"176137165529743660388890842838536840591","length":1435},"id":"CVE-2026-34151-98340505","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"129722177448896361957437634277803763174","length":510},"id":"CVE-2026-34151-98d8e06f","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/79eba8655f3a96021a8e7ad07956e48d20a82383","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/internal/skin/AbstractResourceSkin.java","function":"getProperties"}},{"deprecated":false,"digest":{"function_hash":"200218917430873068133683332990877992346","length":503},"id":"CVE-2026-34151-9aa91114","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/f7b33704083d3b4e45d1b9fc1e2cc33c66855f85","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/test/java/com/xpn/xwiki/internal/template/InternalTemplateManagerTest.java","function":"getFilesystemTemplateWhenTemplateExist"}},{"source":"https://github.com/xwiki/xwiki-platform/commit/f7b33704083d3b4e45d1b9fc1e2cc33c66855f85","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/internal/skin/AbstractResourceSkin.java","function":"getResourceURL"},"deprecated":false,"digest":{"function_hash":"190245899412705784213351568421130417899","length":32},"id":"CVE-2026-34151-9d0ade41","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"212856357623680545125281072383888902777","length":417},"id":"CVE-2026-34151-9f19d516","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/f7b33704083d3b4e45d1b9fc1e2cc33c66855f85","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/test/java/com/xpn/xwiki/internal/template/TemplateManagerTest.java","function":"templateCheatingProtection"}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/f7b33704083d3b4e45d1b9fc1e2cc33c66855f85","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/test/java/com/xpn/xwiki/test/AbstractBridgedComponentTestCase.java"},"deprecated":false,"digest":{"line_hashes":["235190175480106620334295976597979215331","302740459371187849698386808867157376419","62827832118433580762453979094030356877","113723315751737386631070785169694314438","194412801173949947699688108246807793307","232675833411256460770738647862497150572","177147229899459879911043214054951978480","292118809114629268034555588553423565808","219239924458430763431124422674179490357","329932225049063915511160713968766202332","299891488640577396534227809853070747216","28963974413348082843648827781833786237","57634262111760689803423628524145756751"],"threshold":0.9},"id":"CVE-2026-34151-9fe5ef69"},{"deprecated":false,"digest":{"length":388,"function_hash":"130565775866358379972010694764650440969"},"id":"CVE-2026-34151-a342b635","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/79eba8655f3a96021a8e7ad07956e48d20a82383","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/test/java/com/xpn/xwiki/internal/template/TemplateManagerTest.java","function":"before"}},{"digest":{"function_hash":"165073290140579362649561968287276786302","length":425},"id":"CVE-2026-34151-a38dfa55","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/f7b33704083d3b4e45d1b9fc1e2cc33c66855f85","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/internal/template/InternalTemplateManager.java","function":"checkFilesystemTemplate"},"deprecated":false},{"deprecated":false,"digest":{"line_hashes":["6363668461422154296937643851447273328","3334463132925253111089579405328610697","266705894449875378565868622565777523553","134447925644249265935110163198164161956","206709738043918964492633776134260168860","265031576153073715200692122320726002851","68030703474849850337773718496768218473","160612267833931754182104165759055304556","286845519429401420604177826528013058990","259162259698471531334127174840096510433","11437723754083588943704640503307561256","66303229862927134262126065704405943037","286419032140321025518641793969676725967"],"threshold":0.9},"id":"CVE-2026-34151-a4699f0f","signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/f7b33704083d3b4e45d1b9fc1e2cc33c66855f85","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/test/java/com/xpn/xwiki/internal/template/InternalTemplateManagerTest.java"}},{"source":"https://github.com/xwiki/xwiki-platform/commit/79eba8655f3a96021a8e7ad07956e48d20a82383","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/XWiki.java","function":"getResourceAsStream"},"deprecated":false,"digest":{"function_hash":"135215182499297217549185794958926321617","length":195},"id":"CVE-2026-34151-a5b6738f","signature_type":"Function","signature_version":"v1"},{"id":"CVE-2026-34151-aa0c01f0","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/f7b33704083d3b4e45d1b9fc1e2cc33c66855f85","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/web/SkinAction.java","function":"renderFileFromFilesystem"},"deprecated":false,"digest":{"function_hash":"186487606896186402091649445831535606354","length":1427}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/f7b33704083d3b4e45d1b9fc1e2cc33c66855f85","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/internal/skin/AbstractResourceSkin.java"},"deprecated":false,"digest":{"line_hashes":["142074888839739170541232213876977035427","327074528641518854530266914777372152856","335986534415102149130606713770854567690","76502279661932985033582416630159513656","161830793145210615100902758588910871703","291095689416155500204101310173516795390","264962045167373400864741637912991726682","140775772346736594049315071683849645833","285074399939434780332668485681641865110","164466927620930388016406281483205767618","54210663319430935896492536214337928725","332993134774425677597241997788804400288","50421212407939384802532179045658762341","44705270043113546283035903892838603512","149588690454193147062176169779128730130","148044977439898291406745755550851290856","211694727181267924882190934742644970876","266674967085826781964943549664317653261","200450353244946862921384835785685812783","219090563672791696814481105118888075687","64646017531501352923217224734850881661","112419305447059016605326638051600768480","102572734138992820377061469554755201831","67413620121831660795484392002303796323","13512533735871857915243971610658153967","145963406291574618646425851945579089579","152293769254674474484304621037279269508","210027187161391254558233870508799946805","204190986514962853558181754259023699864","234244074825237889108633449272842840306","185069496473877559423279326203122154110","396566652011590193544784542210753870","91324312229271628116429526546676388072","83549708687484495734586093876807974970","252117913014726466809137827758823822206","103855412457694787076917395569151471136","175291003262625270933647496218268505848","203891894339652230964727682998902680504","169513149005427662867885778436754864534","119701848822680988984852956919007611827","117492513071110519189373016622557042384","221289872850157775874006882723951845663","321548997062803730278963541078318307289","7790851865976559626202102975683671700","197167865876226007645004008517805833084","110742074119049836297593074559432849007","290274022856604315799748300450335237342","31151696193857685744832720079051652303","322204464759963389042651107439257348742","331174725257236017418981050286295733469","203937333109071130352817706036495980208","217113299700739887282843246842475060405","5341195671021808314631981515801929693","5721011630944325656506387461642741700"],"threshold":0.9},"id":"CVE-2026-34151-aee38938"},{"digest":{"line_hashes":["170225729222046311510180943213928367036","265176597144264959237390245834683278558"],"threshold":0.9},"id":"CVE-2026-34151-b21e4ba7","signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/f7b33704083d3b4e45d1b9fc1e2cc33c66855f85","target":{"file":"xwiki-platform-core/xwiki-platform-flamingo/xwiki-platform-flamingo-skin/xwiki-platform-flamingo-skin-test/xwiki-platform-flamingo-skin-test-docker/src/test/it/org/xwiki/flamingo/test/docker/AllIT.java"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"176137165529743660388890842838536840591","length":1435},"id":"CVE-2026-34151-b2be87c1","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/f7b33704083d3b4e45d1b9fc1e2cc33c66855f85","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/web/SkinAction.java","function":"render"}},{"signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/f7b33704083d3b4e45d1b9fc1e2cc33c66855f85","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/internal/skin/ClassLoaderSkin.java"},"deprecated":false,"digest":{"line_hashes":["63328579253220497186008524473308452548","321977154641677706243402499679550381897","143749114113786350584488962699230090656","339973371066779163909909602374014454034","216893833139351503518892292394951558116","262163804609348040527838782495618927548","68788242105818749800669389527734059927","118490913672693345496712058094526218223","117217485083534223458732612727609244341","288538803194975990093042733347831875825"],"threshold":0.9},"id":"CVE-2026-34151-b552f118","signature_type":"Line"},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["39153963575455003856166799721546454737","13406889127457890779057794123057300182","11281339921519961993417130076430359028","274264383843890629800415414773645410214","82094922024279383640580757101386010936","317723142256848157392057553537090990302","338748643960202198461479371936901802547","317591639040604650992743551802791388851","259685359370789380647277155723376597646","33110292319946403558523324604541033154","219623208282124831069962783334154667739","301756234763224144866092713629553365308","262706647306754625771663724058691242300","242269301427734209915126436749729921179","30320088005138858496038914019998787068","48900532427417365837625409825330253007","194489338868556575611066766770124075852","119863160373795269050115359426819730786","228033805053070037070245152389571187163","300725035250146346474081631279353761944","221249476999098535017556140698718656762","258907920338515376128263309512605933174"]},"id":"CVE-2026-34151-b8101da5","signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/f7b33704083d3b4e45d1b9fc1e2cc33c66855f85","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/test/java/com/xpn/xwiki/internal/skin/EnvironmentSkinTest.java"}},{"signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/f7b33704083d3b4e45d1b9fc1e2cc33c66855f85","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/internal/template/InternalTemplateManager.java","function":"getTemplateRootPath"},"deprecated":false,"digest":{"function_hash":"157925564443495990681451368758478179744","length":238},"id":"CVE-2026-34151-be5e9daf","signature_type":"Function"},{"source":"https://github.com/xwiki/xwiki-platform/commit/79eba8655f3a96021a8e7ad07956e48d20a82383","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/internal/template/InternalTemplateManager.java"},"deprecated":false,"digest":{"line_hashes":["64829931007902739270737032190206717260","306701336123459997047636311303543284839","133641140859348906772827518495313597630","299116414072824112348207728019658306905","5152219564388862535672049220602020503","137763263822974961212197921343116804395","259318370235987005809301028823586196591","245647036906987330148606478072278542979","222169732212157056209394564964188650037","275090703068363085138381827241878466405","150233789943078320741906891366655647059","227390059743639935945870903870881663387","103627385648775785323205670573384829944","319477850581091157019191054875761322697","284774354655697963438523956429980611459","182428623866614722792829242499344369701","33890409434483601449512428784799660752","160637619944718272046770764906280703942","89966030583945563862012545723513488221","180649478633199969771617541041476597138","124116400054528853131254565409895673813","264052389015465017579846711667809460879","294538652730384745842494604632538671838","200388730513030634715960990776209355597","330766215783492842006617896938040752347","130913513363065899595981050087503565493","80193720626049397795564737089516347544","191577750846048893310420608124800375098","102522916776703784363112710388629684831","2921726848869011180691041639991479746","159953729594859139046951974653221303946","42051051167959029836891487437367616901","145504907135679892999231721630548882731","237280300993772916533353441932939690263","303264583947196160105710140209876743634","206618481538622450500265916360073807638","225891098860292948521010488914897196410","318734402637867392784554728141587792715","151294525547817470097093901928759307728","335391923332883398951730313256478179123","201813785989310512801353197422550506197","63023319149774050960125992398873200987","69349446291585749390597458145774047831","133930823083195803866133400081321943040","22557479717946682599169899470212483752","306871616209780322617165099908737646402","278867883783892739054663752480520240785","156220754693425221508199242700430553486","161449640809119437599610149379721085327","177166899179645215363161412587299798591","277549147786040965686235080429303019509","337537468189236378849484618456133968067"],"threshold":0.9},"id":"CVE-2026-34151-c8d3b302","signature_type":"Line","signature_version":"v1"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/f7b33704083d3b4e45d1b9fc1e2cc33c66855f85","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/internal/template/InternalTemplateManager.java","function":"initialize"},"deprecated":false,"digest":{"length":286,"function_hash":"74304154703462254701507054662707654660"},"id":"CVE-2026-34151-c9eae353"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/f7b33704083d3b4e45d1b9fc1e2cc33c66855f85","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/web/SkinAction.java","function":"renderFileFromAttachment"},"deprecated":false,"digest":{"function_hash":"103709658315511026189371917160391799167","length":986},"id":"CVE-2026-34151-cce0f80c"},{"deprecated":false,"digest":{"function_hash":"163829157298260825528746816133429025439","length":304},"id":"CVE-2026-34151-cf6c73f4","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/f7b33704083d3b4e45d1b9fc1e2cc33c66855f85","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/internal/skin/AbstractResourceSkin.java","function":"getSkinResourcePath"}},{"digest":{"function_hash":"313590985328556485904794250123092671536","length":486},"id":"CVE-2026-34151-cfa3ca38","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/79eba8655f3a96021a8e7ad07956e48d20a82383","target":{"function":"getSkinCreateEnvironmentWiki","file":"xwiki-platform-core/xwiki-platform-oldcore/src/test/java/com/xpn/xwiki/internal/skin/InternalSkinManagerTest.java"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"313590985328556485904794250123092671536","length":486},"id":"CVE-2026-34151-d367ef2c","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/f7b33704083d3b4e45d1b9fc1e2cc33c66855f85","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/test/java/com/xpn/xwiki/internal/skin/InternalSkinManagerTest.java","function":"getSkinCreateEnvironmentWiki"}},{"deprecated":false,"digest":{"line_hashes":["63328579253220497186008524473308452548","321977154641677706243402499679550381897","143749114113786350584488962699230090656","339973371066779163909909602374014454034","216893833139351503518892292394951558116","262163804609348040527838782495618927548","68788242105818749800669389527734059927","118490913672693345496712058094526218223","117217485083534223458732612727609244341","288538803194975990093042733347831875825"],"threshold":0.9},"id":"CVE-2026-34151-dc807df2","signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/79eba8655f3a96021a8e7ad07956e48d20a82383","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/internal/skin/ClassLoaderSkin.java"}},{"source":"https://github.com/xwiki/xwiki-platform/commit/79eba8655f3a96021a8e7ad07956e48d20a82383","target":{"function":"exists","file":"xwiki-platform-core/xwiki-platform-oldcore/src/test/java/com/xpn/xwiki/internal/skin/EnvironmentSkinTest.java"},"deprecated":false,"digest":{"function_hash":"294751141044601334356986959168096267316","length":269},"id":"CVE-2026-34151-dcab54c9","signature_type":"Function","signature_version":"v1"},{"id":"CVE-2026-34151-e0025381","signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/79eba8655f3a96021a8e7ad07956e48d20a82383","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/test/java/com/xpn/xwiki/internal/skin/ClassLoaderSkinTest.java"},"deprecated":false,"digest":{"line_hashes":["300521186603654054403607624646777299346","70389864451945792318823681564078851953","204654976240122846852865188765407183980","106161539821157325003819756249043849365","109073689258820863673638585271664081581","217965722379163487871040476901245775395","227691344010066131540920899797210075142","133314460298347672437681425612969919825","123609781873462907174932036995444124480","101047779524773154082376535404430548369"],"threshold":0.9}},{"deprecated":false,"digest":{"line_hashes":["6363668461422154296937643851447273328","3334463132925253111089579405328610697","266705894449875378565868622565777523553","134447925644249265935110163198164161956","206709738043918964492633776134260168860","265031576153073715200692122320726002851","68030703474849850337773718496768218473","160612267833931754182104165759055304556","286845519429401420604177826528013058990","259162259698471531334127174840096510433","11437723754083588943704640503307561256","66303229862927134262126065704405943037","286419032140321025518641793969676725967"],"threshold":0.9},"id":"CVE-2026-34151-e226b679","signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/79eba8655f3a96021a8e7ad07956e48d20a82383","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/test/java/com/xpn/xwiki/internal/template/InternalTemplateManagerTest.java"}},{"digest":{"line_hashes":["78000442994448159590155954623853709487","235875755039387923254904131153819034167","124452133435048639605850144392464995720","85902593647585579543958965141678906858","220501905699858577119439395267464780271","176128704048733173273073272248164109009","95498359009023582018762030746580421671","252524101829924438326450502405920046574","236488403619014249870582280165239891883","166663699944717887157108920015638756172","63594335616611318037526247020192484273","7968086269558929138461969524490425804","91716380383596577434798521600729342911","29267201724934462310427511995797490087","3254110841940356135055905060190061576","136410947894291515967932610243496045740","309799962743369422407715198869549289458","60736398006401068193484407686705493475"],"threshold":0.9},"id":"CVE-2026-34151-e383c662","signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/f7b33704083d3b4e45d1b9fc1e2cc33c66855f85","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/test/java/com/xpn/xwiki/internal/template/TemplateManagerTest.java"},"deprecated":false},{"target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/internal/skin/EnvironmentSkin.java","function":"exists"},"deprecated":false,"digest":{"function_hash":"106495756020413414240404709127764884090","length":65},"id":"CVE-2026-34151-e477b7e5","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/79eba8655f3a96021a8e7ad07956e48d20a82383"},{"signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/79eba8655f3a96021a8e7ad07956e48d20a82383","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/internal/skin/AbstractResourceSkin.java","function":"getResourceURL"},"deprecated":false,"digest":{"function_hash":"190245899412705784213351568421130417899","length":32},"id":"CVE-2026-34151-e49f52ea","signature_type":"Function"},{"id":"CVE-2026-34151-e7ad3e98","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/f7b33704083d3b4e45d1b9fc1e2cc33c66855f85","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/internal/skin/AbstractResourceSkin.java","function":"getLocalResource"},"deprecated":false,"digest":{"function_hash":"5939226520039135681313115020897886586","length":166}},{"deprecated":false,"digest":{"line_hashes":["113526046620326743688481245556018818184","282708677859948887296011121094732026216","275403056217916293210168318840949272370","108354154064706869867574378801370401830","257088331053072191302690906151580254703","319334552476938239468907394582426995508","187961616637571630093957532291548185742","19475756381353058678328139151560016577"],"threshold":0.9},"id":"CVE-2026-34151-eb04f991","signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/79eba8655f3a96021a8e7ad07956e48d20a82383","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/test/java/com/xpn/xwiki/internal/skin/InternalSkinManagerTest.java"}},{"deprecated":false,"digest":{"function_hash":"16772595621620743662200847589994027964","length":1258},"id":"CVE-2026-34151-f0f4f219","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/f7b33704083d3b4e45d1b9fc1e2cc33c66855f85","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/test/java/com/xpn/xwiki/test/AbstractBridgedComponentTestCase.java","function":"setUp"}},{"id":"CVE-2026-34151-fb64cd25","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/f7b33704083d3b4e45d1b9fc1e2cc33c66855f85","target":{"function":"getLocalResourceWithBreakInAttempt","file":"xwiki-platform-core/xwiki-platform-oldcore/src/test/java/com/xpn/xwiki/internal/skin/EnvironmentSkinTest.java"},"deprecated":false,"digest":{"function_hash":"186839476894508223552600459533284152722","length":210}},{"signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/79eba8655f3a96021a8e7ad07956e48d20a82383","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/test/java/com/xpn/xwiki/internal/template/InternalTemplateManagerTest.java","function":"getFilesystemTemplateWhenTemplateExist"},"deprecated":false,"digest":{"function_hash":"200218917430873068133683332990877992346","length":503},"id":"CVE-2026-34151-fc7e84ac","signature_type":"Function"}],"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-34151.json","vanir_signatures_modified":"2026-09-16T08:11:35Z"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"}]}