{"id":"CVE-2026-34151","aliases":[],"url":"https://o3.security/vulnerability/CVE-2026-34151","summary":"XWiki Platform Old Core: Resource path traversal via /skin/ action endpoint in Jetty 12+","details":"### Impact\n\nWith Jetty 12+ a user can craft a URL to access any resource the Jetty instance is allowed to access.\n\nFor example `http://[host]/xwiki/bin/skin/..%252f/..%252f..%252f..%252f..%252f..%252f..%252f..%252fetc/passwd` allows downloading the content of the /etc/passwd file, provided Jetty is allowed to read it, and if your XWiki webapp is located exactly 5 levels below `/` (like `/var/lib/jetty/webapps/xwiki`, which is the case in the docker image, for example).\n\nAnother example which does not go out of the XWiki webapp, but it's still a vulnerability (since users should not be allowed to access Hibernate or XWiki configuration files) is `http://[host]/xwiki/bin/skin/..%252f/..%252fWEB-INF/xwiki.cfg`.\n\n### Patches\n\nThis vulnerability has been patched in XWiki 17.10.5 and 18.2.0.\n\n### Workarounds\n\nA possible workaround is to use a different application server, like Jetty < 12 (in the case of XWiki < 17) or Tomcat, which don't seem to be impacted.\n\n### Resources\n\n* https://jira.xwiki.org/browse/XWIKI-24075\n* https://jira.xwiki.org/browse/XCOMMONS-3594\n\n### For more information\n\nIf there are any questions or comments about this advisory:\n* Open an issue in [Jira XWiki.org](https://jira.xwiki.org/)\n* Send an email to the [Security Mailing List](mailto:security@xwiki.org)\n\n### Attribution\n\n Lê Ngọc Khoa reported the vulnerability.","published":"2026-07-07T13:01:21Z","modified":"2026-07-07T13:26:30.500387Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"Maven","name":"org.xwiki.platform:xwiki-platform-oldcore","fixedVersion":"17.10.5"},{"ecosystem":"Maven","name":"org.xwiki.platform:xwiki-platform-oldcore","fixedVersion":"18.2.0"}],"fix":{"url":"https://github.com/xwiki/xwiki-commons/pull/1675","label":"xwiki/xwiki-commons#1675"},"references":[{"type":"WEB","url":"https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-qj4x-9g63-25g6"},{"type":"WEB","url":"https://github.com/xwiki/xwiki-commons/pull/1675"},{"type":"PACKAGE","url":"https://github.com/xwiki/xwiki-platform"},{"type":"WEB","url":"https://jira.xwiki.org/browse/XCOMMONS-3594"},{"type":"WEB","url":"https://jira.xwiki.org/browse/XWIKI-24075"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-07-07T13:26:30.500387Z"}}