CVE-2026-48047 XWiki Platform vulnerable to potential arbitrary file writing using path traversal from (subwiki) admin

XWiki Platform WebJars API is a package for XWiki, a generic wiki platform. Starting with version 9.6-rc-1 and prior to versions 16.10.17, 17.4.9, and 17.10.3, a potential path traversal vulnerability allow an attacker who manages to get a malicious WebJar extension installed on the wiki to write...

CVE-2026-48047

Affected component: XWiki Platform WebJars API (org.xwiki.platform:xwiki-platform-webjars-api). Vulnerability: Path traversal that can let an attacker write arbitrary files (e.g., configuration files or superadmin password) after installing a malicious WebJar extension and publishing it to a conf...

GHSA-VGWR-23FQ-PR7G XWiki Platform vulnerable to potential arbitrary file writing using path traversal from (subwiki) admin

Impact A potential path traversal vulnerability allow an attacker who manages to get a malicious WebJar extension installed on the wiki to write arbitrary files. While the consequences could be severe like overriding configuration files and setting the superadmin password, the attack first requir...

org.xwiki.commons:xwiki-commons-extension-api (>=17.5.0, <=17.10.2), org.xwiki.commons:xwiki-commons-extension-handler-jar (>=17.5.0, <=17.10.2) +10 more potentially affected by CVE-2026-23734 via org.xwiki.commons:xwiki-commons-classloader-api (>=17.5.0, <=17.10.2)

org.xwiki.commons:xwiki-commons-classloader-api MAVEN version =17.5.0, =17.5.0, =17.5.0, =17.5.0, =17.5.0, =17.5.0, =17.5.0, =17.5.0, =17.5.0, =17.5.0, =17.5.0, =17.10.0-rc-1, =17.5.0, =17.10.2 Source cves: CVE-2026-23734 Source advisory: OSV:GHSA-XQ3R-2QV5-VQQM...

org.xwiki.commons:xwiki-commons-extension-api (>=18.0.0-rc-1, <=18.0.1), org.xwiki.commons:xwiki-commons-extension-handler-jar (>=18.0.0-rc-1, <=18.0.1) +10 more potentially affected by CVE-2026-23734 via org.xwiki.commons:xwiki-commons-classloader-api (>=18.0.0-rc-1, <=18.0.1)

org.xwiki.commons:xwiki-commons-classloader-api MAVEN version =18.0.0-rc-1, =18.0.0-rc-1, =18.0.0-rc-1, =18.0.0-rc-1, =18.0.0-rc-1, =18.0.0-rc-1, =18.0.0-rc-1, =18.0.0-rc-1, =18.0.0-rc-1, =18.0.0-rc-1, =18.0.0-rc-1, =18.0.0-rc-1, =18.0.0-rc-1, =18.0.1 Source cves: CVE-2026-23734 Source advisory:...

org.xwiki.commons:xwiki-commons-extension-api (>=17.0.0-rc-1, <=17.4.8), org.xwiki.commons:xwiki-commons-extension-handler-jar (>=17.0.0-rc-1, <=17.4.8) +9 more potentially affected by CVE-2026-23734 via org.xwiki.commons:xwiki-commons-classloader-api (>=17.0.0-rc-1, <=17.4.8)

org.xwiki.commons:xwiki-commons-classloader-api MAVEN version =17.0.0-rc-1, =17.0.0-rc-1, =17.0.0-rc-1, =17.0.0-rc-1, =17.0.0-rc-1, =17.0.0-rc-1, =17.0.0-rc-1, =17.0.0-rc-1, =17.0.0-rc-1, =17.0.0-rc-1, =17.0.0-rc-1, =17.0.0-rc-1, =17.4.8 Source cves: CVE-2026-23734 Source advisory:...

org.xwiki.commons:xwiki-commons-extension-api (>=17.5.0, <=17.10.2), org.xwiki.commons:xwiki-commons-extension-handler-jar (>=17.5.0, <=17.10.2) +10 more potentially affected by CVE-2025-55748 +1 more via org.xwiki.commons:xwiki-commons-classloader-api (>=17.5.0, <=17.10.2)

org.xwiki.commons:xwiki-commons-classloader-api MAVEN version =17.5.0, =17.5.0, =17.5.0, =17.5.0, =17.5.0, =17.5.0, =17.5.0, =17.5.0, =17.5.0, =17.5.0, =17.5.0, =17.10.0-rc-1, =17.5.0, =17.10.2 Source cves: CVE-2025-55748, CVE-2026-23734 Source advisory: SNYK:JAVA-ORGXWIKICOMMONS-16786796...

PT-2025-3149

Name of the Vulnerable Software and Affected Versions TYPO3 versions prior to 11.5.42 ELTS TYPO3 versions prior to 12.4.25 LTS TYPO3 versions prior to 13.4.3 LTS Description A vulnerability has been identified in the backend user interface functionality involving deep links, which is susceptible ...

Vulnerabilities fixed in XWiki Platform

XWiki has fixed vulnerabilities in the XWiki Platform Specifically for versions 15.10.9 and 16.3.0. The vulnerabilities are in the way the XWiki Platform handles user permissions. A malicious user with programming privileges can execute code through the Extension Repository Application, or by...

GHSA-J2PQ-22JJ-4PM5 XWiki allows remote code execution through the extension sheet

Impact On instances where Extension Repository Application is installed, any user can execute any code requiring programming rights on the server. In order to reproduce on an instance, as a normal user without script nor programming rights, go to your profile and add an object of type...

XWiki allows remote code execution through the extension sheet

Impact On instances where Extension Repository Application is installed, any user can execute any code requiring programming rights on the server. In order to reproduce on an instance, as a normal user without script nor programming rights, go to your profile and add an object of type...

CVE-2024-55662

XWiki Platform is a generic wiki platform. Starting in version 3.3-milestone-1 and prior to versions 15.10.9 and 16.3.0, on instances where Extension Repository Application is installed, any user can execute any code requiring programming rights on the server. This vulnerability has been fixed in...

CVE-2024-55662 XWiki allows remote code execution through the extension sheet

XWiki Platform is a generic wiki platform. Starting in version 3.3-milestone-1 and prior to versions 15.10.9 and 16.3.0, on instances where Extension Repository Application is installed, any user can execute any code requiring programming rights on the server. This vulnerability has been fixed in...

CVE-2024-55662 XWiki allows remote code execution through the extension sheet

XWiki Platform is a generic wiki platform. Starting in version 3.3-milestone-1 and prior to versions 15.10.9 and 16.3.0, on instances where Extension Repository Application is installed, any user can execute any code requiring programming rights on the server. This vulnerability has been fixed in...

CVE-2024-55662 XWiki allows remote code execution through the extension sheet

XWiki Platform is a generic wiki platform. Starting in version 3.3-milestone-1 and prior to versions 15.10.9 and 16.3.0, on instances where Extension Repository Application is installed, any user can execute any code requiring programming rights on the server. This vulnerability has been fixed in...

CVE-2024-55662

XWiki Platform is a generic wiki platform. Starting in version 3.3-milestone-1 and prior to versions 15.10.9 and 16.3.0, on instances where "Extension Repository Application" is installed, any user can execute any code requiring "programming" rights on the server. This vulnerability has been fixe...

CVE-2024-55662

CVE-2024-55662 affects XWiki Platform (3.3-milestone-1 to versions before 15.10.9 and 16.3.0) when the Extension Repository Application is installed. The root cause is that a user with access to the server can execute code requiring programming rights via the Extension Repository Application, ena...

CVE-2024-55662: Improper Neutralization of Directives in Statically Saved Code

XWiki Platform is a generic wiki platform. Starting in version 3.3-milestone-1 and prior to versions 15.10.9 and 16.3.0, on instances where Extension Repository Application is installed, any user can execute any code requiring programming rights on the server. This vulnerability has been fixed in...

PT-2024-36576 · Unknown · Xwiki Platform

Name of the Vulnerable Software and Affected Versions: XWiki Platform versions 3.3-milestone-1 through 15.10.8 XWiki Platform versions 3.3-milestone-1 through 16.2.x Description: XWiki Platform is a generic wiki platform. On instances where Extension Repository Application is installed, any user...

XWiki Platform security vulnerabilities

XWiki Platform is the XWiki open source suite of Wiki platforms for creating web collaboration applications. A security vulnerability exists in XWiki Platform versions 3.3-milestone-1 through 16.3.0, which stems from the fact that on an instance with the Extension Repository Application installed...