Sign in
Deutsch English Español Polski
High

XWiki Platform Old Core: Resource path traversal via /skin/ action endpoint in Jetty 12+

  • Disclosed: 07.07.2026
  • Updated: 11.10.2026 12:22

Impact

With Jetty 12+ a user can craft a URL to access any resource the Jetty instance is allowed to access.

For example http://[host]/xwiki/bin/skin/..%252f/..%252f..%252f..%252f..%252f..%252f..%252f..%252fetc/passwd allows downloading the content of the /etc/passwd file, provided Jetty is allowed to read it, and if your XWiki webapp is located exactly 5 levels below / (like /var/lib/jetty/webapps/xwiki, which is the case in the docker image, for example).

Another example which does not go out of the XWiki webapp, but it's still a vulnerability (since users should not be allowed to access Hibernate or XWiki configuration files) is http://[host]/xwiki/bin/skin/..%252f/..%252fWEB-INF/xwiki.cfg.

Patches

This vulnerability has been patched in XWiki 17.10.5 and 18.2.0.

Workarounds

A possible workaround is to use a different application server, like Jetty < 12 (in the case of XWiki < 17) or Tomcat, which don't seem to be impacted.

Resources

For more information

If there are any questions or comments about this advisory:

Attribution

Lê Ngọc Khoa reported the vulnerability.

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
Java / Kotlin (Maven) org.xwiki.platform:xwiki-platform-oldcore < 17.10.5, >= 18.0.0-rc-1, < 18.2.0 17.10.5, 18.2.0

References

CVSS score -
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Weakness (CWE)
CWE-24
Platform
Java / Kotlin (Maven)
Package
org.xwiki.platform:xwiki-platform-oldcore
Disclosed
07.07.2026
Updated
11.10.2026 12:22

Sources and licenses

OSV / GitHub Advisory Database - GHSA-qj4x-9g63-25g6 - CC BY 4.0

Vulnerability history: org.xwiki.platform:xwiki-platform-oldcore

All published vulnerabilities of this package (Java / Kotlin (Maven)), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (46) in the archive
Total entries
46
First → latest
09.2020 07.2026
Without a fix
0
Exploited in attacks
0

Severity breakdown

  • Critical 12
  • High 17
  • Medium 15
  • Low 2

Disclosures per year

Severity:
  1. XWiki Platform Old Core: Resource path traversal via /skin/ action endpoint in Jetty 12+ this entry
    High CVE-2026-34151 < 17.10.5, >= 18.0.0-rc-1, < 18.2.0 17.10.5, 18.2.0
  2. XWiki vulnerable to remote code execution with script right through unprotected Velocity scripting API
    High CVE-2026-33229 >= 17.0.0-rc-1, < 17.4.8, >= 17.5.0-rc-1, < 17.10.1 17.4.8, 17.10.1
  3. XWiki exposes passwords and emails stored in fields not named password/email in xml.vm
    High CVE-2025-54125 >= 1.1, < 16.4.7, >= 16.5.0-rc-1, < 16.10.5, >= 17.0.0-rc-1, < 17.2.0-rc-1 16.4.7, 16.10.5, 17.2.0-rc-1
  4. XWiki leaks password hashes and other accessible password properties
    High CVE-2025-54124 >= 9.8-rc-1, < 16.4.7, >= 16.5.0-rc-1, < 16.10.5, >= 17.0.0-rc-1, < 17.2.0-rc-1 16.4.7, 16.10.5, 17.2.0-rc-1
  5. XWiki Platform vulnerable to SQL injection through XWiki#searchDocuments API
    High CVE-2025-54385 >= 1.0, < 16.10.6, >= 17.0.0-rc1, < 17.3.0-rc-1 16.10.6, 17.3.0-rc-1
  6. XWiki allows remote code execution through preview of XClass changes in AWM editor
    High CVE-2025-49586 >= 7.2-milestone-2, < 16.4.7, >= 16.5.0-rc-1, < 16.10.3, >= 17.0.0-rc-1, < 17.0.0 16.4.7, 16.10.3, 17.0.0
  7. XWiki allows SQL injection in query endpoint of REST API with Oracle
    Critical CVE-2024-56158 >= 1.0, < 15.10.16, >= 16.0.0-rc-1, < 16.4.7, >= 16.5.0-rc-1, < 16.10.2 15.10.16, 16.4.7, 16.10.2
  8. org.xwiki.platform:xwiki-platform-oldcore allows SQL injection in short form select requests through the script query API
    High CVE-2025-32968 >= 1.6-milestone-1, < 15.10.16, >= 16.0.0-rc-1, < 16.4.6, >= 16.5.0-rc-1, < 16.10.1 15.10.16, 16.4.6, 16.10.1
  9. XWiki Platform allows XSS through XClass name in string properties
    Critical · 9.0 CVE-2024-43400 >= 1.1.2, < 14.10.21, >= 15.0-rc-1, < 15.5.5, >= 15.6-rc-1, < 15.10.6, >= 16.0.0-rc-1, < 16.0.0 14.10.21, 15.5.5, 15.10.6, 16.0.0
  10. XWiki Platform allows remote code execution from user account
    Critical · 9.0 CVE-2024-37899 >= 13.4.7, < 14.10.21, >= 13.10.3, < 14.10.21, >= 15.0-rc-1, < 15.5.5, >= 15.6-rc-1, < 15.10.6, >= 16.0.0-rc-1, < 16.0.0 14.10.21, 15.5.5, 15.10.6, 16.0.0
  11. XWiki Platform remote code execution from account via custom skins support
    Critical · 9.9 CVE-2024-31987 >= 6.4-milestone-1, < 14.10.19, >= 15.0-rc-1, < 15.5.4, >= 15.6-rc-1, < 15.10-rc-1 14.10.19, 15.5.4, 15.10-rc-1
  12. XWiki Platform: Privilege escalation (PR) from user registration through PDFClass
    Critical · 9.9 CVE-2024-31981 >= 3.0.1, < 14.10.20, >= 15.0-rc-1, < 15.5.4, >= 15.6-rc-1, < 15.10-rc-1 14.10.20, 15.5.4, 15.10-rc-1
  13. XWiki has no right protection on rollback action
    High · 8.0 CVE-2024-21648 >= 1.0, < 14.10.17 14.10.17
  14. XWiki Platform vulnerable to privilege escalation and remote code execution via the edit action
    High · 8.8 CVE-2023-46243 >= 15.0, < 15.2-rc-1, >= 1.0, < 14.10.6 15.2-rc-1, 14.10.6
  15. XWiki Platform vulnerable to remote code execution via the edit action because it lacks CSRF token
    Critical · 9.6 CVE-2023-46242 >= 1.0, < 14.10.7, >= 15.0, < 15.2-rc-1 14.10.7, 15.2-rc-1
  16. XWiki Platform vulnerable to CSRF privilege escalation/RCE via the create action
    High · 8.0 CVE-2023-40572 >= 3.2-milestone-3, < 14.10.9, >= 15.0-rc-1, < 15.4-rc-1 14.10.9, 15.4-rc-1
  17. Upgrading doesn't prevent exploiting vulnerable XWiki documents
    Critical · 9.9 CVE-2023-36468 >= 2.0, < 14.10.7, >= 15.0-rc-1, < 15.2-rc-1 14.10.7, 15.2-rc-1
  18. XWiki Platform vulnerable to reflected cross-site scripting via delattachment action
    High · 8.4 CVE-2023-35157 >= 3.2-milestone-3, < 14.10.6, >= 15.0-rc-0, < 15.1-rc-1 14.10.6, 15.1-rc-1
  19. XWiki Platform's async and display macro allow displaying and interacting with any document in restricted mode
    Critical · 9.9 CVE-2023-29526 >= 10.11.1, < 13.10.11, >= 14.0-rc-1, < 14.4.8, >= 14.5, < 14.10.3 13.10.11, 14.4.8, 14.10.3
  20. XWiki Platform vulnerable to code injection in display method used in user profiles
    Critical · 9.9 CVE-2023-29523 >= 3.3-milestone-1, < 13.10.11, >= 14.0-rc-1, < 14.4.8, >= 14.5, < 14.10.2 13.10.11, 14.4.8, 14.10.2
  21. org.xwiki.platform:xwiki-platform-oldcore makes Incorrect Use of Privileged APIs with DocumentAuthors
    Critical · 9.1 CVE-2023-29507 >= 14.5, < 14.10, >= 14.4.1, < 14.4.7 14.10, 14.4.7
  22. org.xwiki.platform:xwiki-platform-oldcore vulnerable to data leak through deleted documents
    High · 7.5 CVE-2023-29208 >= 1.2-milestone-1, < 13.10.11, >= 14.0-rc-1, < 14.4.7, >= 14.5, < 14.10 13.10.11, 14.4.7, 14.10
  23. XWiki Platform vulnerable to privilege escalation via properties with wiki syntax that are executed with wrong author
    Critical · 9.9 CVE-2023-26474 >= 13.10, < 13.10.11, >= 14.0, < 14.4.7, >= 14.5, < 14.10 13.10.11, 14.4.7, 14.10
  24. Creation of new database tables through login form on PostgreSQL
    High · 7.5 CVE-2022-41932 < 13.10.8, >= 14.0.0, < 14.4.2, >= 14.5.0, < 14.6-rc-1 13.10.8, 14.4.2, 14.6-rc-1
  25. XWiki.WebHome vulnerable to Improper Privilege Management in XWiki resolving groups
    High · 8.1 CVE-2022-31166 >= 11.3.7, < 13.10.4, >= 14.0-rc-1, < 14.2-rc-1 13.10.4, 14.2-rc-1
  26. XWiki Platform Improper Authorization check for inactive users
    High · 8.1 CVE-2022-36090 >= 1.1, < 13.10.5, >= 14.0, < 14.3-rc-1 13.10.5, 14.3-rc-1
  27. XWiki Platform Old Core vulnerable to Authentication Bypass Using the Login Action
    High · 7.5 CVE-2022-36092 < 13.10.4, >= 14.0, < 14.2 13.10.4, 14.2
  28. XSS Cross Site Scripting
    Critical · 9.6 CVE-2021-29459 < 12.6.3, >= 12.6.4, < 12.8 12.6.3, 12.8
  29. RCE in XWiki
    High · 8.5 CVE-2020-15252 < 11.10.6, >= 12.0, < 12.5 11.10.6, 12.5

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.