org.xwiki.commons:xwiki-commons-extension-api (>=17.5.0, <=17.10.2), org.xwiki.commons:xwiki-commons-extension-handler-jar (>=17.5.0, <=17.10.2) +10 more potentially affected by CVE-2026-23734 via org.xwiki.commons:xwiki-commons-classloader-api (>=17.5.0, <=17.10.2)

org.xwiki.commons:xwiki-commons-classloader-api MAVEN version =17.5.0, =17.5.0, =17.5.0, =17.5.0, =17.5.0, =17.5.0, =17.5.0, =17.5.0, =17.5.0, =17.5.0, =17.5.0, =17.10.0-rc-1, =17.5.0, =17.10.2 Source cves: CVE-2026-23734 Source advisory: MEND:CVE-2026-23734...

CVE-2026-23734 XWiki Platform: Path traversal via resources parameter in ssx and jsx endpoints when using leading slash

XWiki Platform is a generic wiki platform. Versions prior to 18.1.0-rc-1, 17.10.3, 17.4.9, and 16.10.17 allow access to read configuration files by using URLs such as http://localhost:8080/bin/ssx/Main/WebHome?resource=/../../WEB-INF/xwiki.cfg&minify=false, leading to Path Traversal. The...