{"id":"GHSA-qj4x-9g63-25g6","summary":"XWiki Platform Old Core: Resource path traversal via /skin/ action endpoint in Jetty 12+","details":"### Impact\n\nWith Jetty 12+ a user can craft a URL to access any resource the Jetty instance is allowed to access.\n\nFor example `http://[host]/xwiki/bin/skin/..%252f/..%252f..%252f..%252f..%252f..%252f..%252f..%252fetc/passwd` allows downloading the content of the /etc/passwd file, provided Jetty is allowed to read it, and if your XWiki webapp is located exactly 5 levels below `/` (like `/var/lib/jetty/webapps/xwiki`, which is the case in the docker image, for example).\n\nAnother example which does not go out of the XWiki webapp, but it's still a vulnerability (since users should not be allowed to access Hibernate or XWiki configuration files) is `http://[host]/xwiki/bin/skin/..%252f/..%252fWEB-INF/xwiki.cfg`.\n\n### Patches\n\nThis vulnerability has been patched in XWiki 17.10.5 and 18.2.0.\n\n### Workarounds\n\nA possible workaround is to use a different application server, like Jetty \u003c 12 (in the case of XWiki \u003c 17) or Tomcat, which don't seem to be impacted.\n\n### Resources\n\n* https://jira.xwiki.org/browse/XWIKI-24075\n* https://jira.xwiki.org/browse/XCOMMONS-3594\n\n### For more information\n\nIf there are any questions or comments about this advisory:\n* Open an issue in [Jira XWiki.org](https://jira.xwiki.org/)\n* Send an email to the [Security Mailing List](mailto:security@xwiki.org)\n\n### Attribution\n\n Lê Ngọc Khoa reported the vulnerability.","aliases":["CVE-2026-34151"],"modified":"2026-07-07T13:26:30.500387Z","published":"2026-07-07T13:01:21Z","database_specific":{"github_reviewed":true,"github_reviewed_at":"2026-07-07T13:01:21Z","nvd_published_at":null,"cwe_ids":["CWE-24"],"severity":"HIGH"},"references":[{"type":"WEB","url":"https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-qj4x-9g63-25g6"},{"type":"WEB","url":"https://github.com/xwiki/xwiki-commons/pull/1675"},{"type":"PACKAGE","url":"https://github.com/xwiki/xwiki-platform"},{"type":"WEB","url":"https://jira.xwiki.org/browse/XCOMMONS-3594"},{"type":"WEB","url":"https://jira.xwiki.org/browse/XWIKI-24075"}],"affected":[{"package":{"name":"org.xwiki.platform:xwiki-platform-oldcore","ecosystem":"Maven","purl":"pkg:maven/org.xwiki.platform/xwiki-platform-oldcore"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.10.5"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-qj4x-9g63-25g6/GHSA-qj4x-9g63-25g6.json"}},{"package":{"name":"org.xwiki.platform:xwiki-platform-oldcore","ecosystem":"Maven","purl":"pkg:maven/org.xwiki.platform/xwiki-platform-oldcore"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"18.0.0-rc-1"},{"fixed":"18.2.0"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-qj4x-9g63-25g6/GHSA-qj4x-9g63-25g6.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"}]}