CVE-2026-23734 XWiki Platform: Path traversal via resources parameter in ssx and jsx endpoints when using leading slash

[
  {
    "vendor": "xwiki",
    "product": "xwiki-commons",
    "versions": [
      {
        "version": ">= 4.2-milestone-2, < 16.10.17",
        "status": "affected"
      },
      {
        "version": ">= 17.0.0-rc-1, < 17.4.9",
        "status": "affected"
      },
      {
        "version": ">= 17.5.0, < 17.10.3",
        "status": "affected"
      },
      {
        "version": ">= 18.0.0-rc-1, < 18.1.0-rc-1",
        "status": "affected"
      }
    ]
  }
]