CVE Intelligence
Analysis AI-assisted

CVE-2026-23734: XWiki Platform: Path Traversal Exposes Configuration Files

Versions of XWiki Platform before 18.1.0-rc-1, 17.10.3, 17.4.9 and 16.10.17 contain a path traversal weakness (CWE-23) that can expose configuration files through the ssx and jsx endpoints. The GitHub CNA scored it 9.3 (critical) under CVSS 4.0, and the record lists the issue as patched in the versions named above. The record does not list the vulnerability in CISA KEV, and no confirmed exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

XWiki Platform is a generic wiki platform. The GitHub advisory tied to CVE-2026-23734 describes a path traversal weakness (CWE-23) in the ssx and jsx endpoints that can lead to reading server configuration files.

Impact

  • The record describes read access to configuration files, which may expose internal settings of the wiki.
  • The CVSS 4.0 vector assigned by the GitHub CNA indicates high impact on confidentiality, integrity and availability of the vulnerable system, which is broader than the read access described in the text.
  • Because the vector shows no privileges and no user interaction required, the record classifies the issue as reachable over the network.

Affected products and versions

  • Product: XWiki Platform.
  • Versions prior to 18.1.0-rc-1, 17.10.3, 17.4.9 and 16.10.17 are described as affected.
  • The record's structured affected and fixes fields are empty, so the version list comes from the description text only.

Exploitation status

  • The record does not list this CVE in CISA KEV.
  • No confirmed exploitation in the wild appears in the sources consulted for this analysis.
  • The EPSS data in the record gives a probability of 0.19559 and a percentile of 0.9733, which is a statistical estimate and not evidence of exploitation.

Remediation and mitigation

  • Upgrade XWiki Platform to a release listed as patched: 18.1.0-rc-1, 17.10.3, 17.4.9 or 16.10.17, matching the installed branch.
  • If an upgrade cannot be done immediately, restrict access to the wiki and its endpoints to trusted networks and review access controls on the affected endpoints.
  • Review the GitHub advisory and linked commit for the vendor's own guidance.

Detection guidance

  • Review web server and application logs for requests to the ssx and jsx endpoints that include path traversal sequences or unusual resource parameter values.
  • Check whether configuration files were accessed through the web interface and treat any unexpected access as a potential incident.
  • Confirm the running version of XWiki Platform against the patched release list.

Limitations of the available information

  • The record's affected and fixed fields are empty, so the list of affected branches and any other fixed releases is unknown beyond the description.
  • The record title is missing and the source status is Deferred, so the information may change.
  • The record does not provide the exact configuration files or data that could be exposed, which is unknown.
  • The example URL in the original description is omitted from this analysis to avoid publishing a working request.

Frequently asked questions

Which XWiki Platform versions are affected by CVE-2026-23734?

The record describes versions prior to 18.1.0-rc-1, 17.10.3, 17.4.9 and 16.10.17 as affected. The structured affected list in the record is empty, so the description is the only version source.

Is CVE-2026-23734 known to be exploited in the wild?

The record does not list it in CISA KEV, and no confirmed exploitation appears in the sources consulted. The EPSS score is a statistical estimate, not proof of exploitation.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.