How severe is CVE-2026-23734?

No CVSS score has been assigned to CVE-2026-23734 yet. Review the advisory details and affected package list to assess your exposure.

Which packages are affected by CVE-2026-23734?

CVE-2026-23734 affects the following packages: org.xwiki.commons:xwiki-commons-classloader-api (Maven), org.xwiki.commons:xwiki-commons-classloader-api (Maven), org.xwiki.commons:xwiki-commons-classloader-api (Maven), org.xwiki.commons:xwiki-commons-classloader-api (Maven). Ecosystems affected: Maven.

How do I fix CVE-2026-23734?

Update org.xwiki.commons:xwiki-commons-classloader-api to 16.10.17 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-23734 is resolved across your whole dependency graph.

How do I detect CVE-2026-23734 in my Maven dependencies?

Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for org.xwiki.commons:xwiki-commons-classloader-api, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

How do I mitigate CVE-2026-23734 if there is no patch (or I can't update yet)?

If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

Is CVE-2026-23734 actively exploited in the wild?

No public exploit code has been indexed for CVE-2026-23734 yet. This does not mean the vulnerability cannot be exploited — absence of public exploits does not imply safety. Apply the recommended fix and use O3 Security to monitor your exposure.

What is the EPSS score for CVE-2026-23734?

CVE-2026-23734 has an EPSS (Exploit Prediction Scoring System) score of 19.6%, placing it in the 97th percentile of all CVEs. EPSS is maintained by FIRST.org and estimates the probability that a vulnerability will be exploited in the wild within the next 30 days. This score warrants monitoring and prompt remediation.

What type of vulnerability is CVE-2026-23734?

CVE-2026-23734 is classified as CWE-23 (CWE-23). This weakness type describe the underlying flaw category, which helps determine the potential impact and the right class of mitigation.

When was CVE-2026-23734 published, and has it been updated?

CVE-2026-23734 was published on May 20, 2026 and was last updated on August 12, 2026. Advisory data evolves as severity scores, affected ranges, and exploit intelligence are revised — always check the latest version of the advisory before acting.

☕ Maven

Not in CISA KEV

CVE-2026-23734 — xwiki-commons-classloader…

Fix: xwiki/xwiki-commons@a979caf

CVE-2026-23734 is a CWE-23 vulnerability in org.xwiki.commons:xwiki-commons-classloader-api. EPSS puts its 30-day exploitation probability at 19.6% (97th percentile). A fix is available for org.xwiki.commons:xwiki-commons-classloader-api — see the affected versions and patch details below.

XWiki Platform: Path traversal via resources parameter in ssx and jsx endpoints when using leading slash

Also known asGHSA-xq3r-2qv5-vqqm

Published

May 20, 2026

Updated

Aug 12, 2026

Affected

4 pkgs

Patched

4 / 4

Exploits

None indexed

Exploitation data as of Oct 2, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

Exploitation Status

No confirmed exploitation observed yet

CISA assesses this as automatable — exploitation doesn’t require manual, per-target effort, which raises the odds of mass scanning and opportunistic attacks.
CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.

Exploitation and automatability from CISA’s SSVC triage for CVE-2026-23734.

EPSS Exploitation Probability

via FIRST.org ↗

19.6%probability of exploitation in next 30 days

Moderate Risk0.00%

Lower risk than most CVEs97th percentile — riskier than 97% of all scored CVEsHighest risk

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

Real-World Exposure

4 pkgs affected

☕org.xwiki.commons:xwiki-commons-classloader-api☕org.xwiki.commons:xwiki-commons-classloader-api☕org.xwiki.commons:xwiki-commons-classloader-api☕org.xwiki.commons:xwiki-commons-classloader-api

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Maven packages — download data is not available via public APIs for these ecosystems.

Description

Impact

It's possible to get access and read configuration files by using URLs such as http://localhost:8080/bin/ssx/Main/WebHome?resource=/../../WEB-INF/xwiki.cfg&minify=false.

This can apparently be reproduced on Tomcat instances.

Patches

This has been patched in 18.0.0-rc-1, 17.10.3, 17.4.9, 16.10.17.

Workarounds

There is no known workaround, other than upgrading XWiki.

References

For more information

If you have any questions or comments about this advisory:

Open an issue in Jira XWiki.org
Email us at Security Mailing List

Attribution

The vulnerability was reported by Michał Kołek.

Affected Packages

4 total 4 fixed

Ecosystem	Package	Vulnerable range	Fix
☕Maven	`org.xwiki.commons:xwiki-commons-classloader-api`	≥ 4.2-milestone-2&&< 16.10.17	16.10.17`org.xwiki.commons:xwiki-commons-classloader-api:16.10.17`
☕Maven	`org.xwiki.commons:xwiki-commons-classloader-api`	≥ 17.0.0-rc-1&&< 17.4.9	17.4.9`org.xwiki.commons:xwiki-commons-classloader-api:17.4.9`
☕Maven	`org.xwiki.commons:xwiki-commons-classloader-api`	≥ 17.5.0&&< 17.10.3	17.10.3`org.xwiki.commons:xwiki-commons-classloader-api:17.10.3`
☕Maven	`org.xwiki.commons:xwiki-commons-classloader-api`	≥ 18.0.0-rc-1&&< 18.1.0-rc-1	18.1.0-rc-1`org.xwiki.commons:xwiki-commons-classloader-api:18.1.0-rc-1`

Detection & mitigation playbook

Open-source dependency

Detect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for org.xwiki.commons:xwiki-commons-classloader-api, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update org.xwiki.commons:xwiki-commons-classloader-api to 16.10.17 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-23734 is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

Frequently Asked Questions

### Impact It's possible to get access and read configuration files by using URLs such as `http://localhost:8080/bin/ssx/Main/WebHome?resource=/../../WEB-INF/xwiki.cfg&minify=false`. This can apparently be reproduced on Tomcat instances. ### Patches This has been patched in 18.0.0-rc-1, 17.10.3, 17.4.9, 16.10.17. ### Workarounds There is no known workaround, other than upgrading XWiki. ### References * https://jira.xwiki.org/browse/XCOMMONS-3547 * https://github.com/xwiki/xwiki-commons/commit/a979cafd89f6a9c9c0b9ab19744d672df64429bf ### For more information If you have any questions

O3 Security · Impact-Aware SCA

Is CVE-2026-23734 in your dependencies?

Find it across Maven, including transitive dependencies.

Scan my dependencies How O3 SCA works