Read the docs
TI-2026-35489 Aliases CVE-2026-48047GHSA-vgwr-23fq-pr7g

XWiki Platform vulnerable to potential arbitrary file writing using path traversal from (subwiki) admin

Priority MEDIUM 60CWE-24Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
Low · High · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.

Summary

XWiki Platform WebJars API is a package for XWiki, a generic wiki platform. Starting with version 9.6-rc-1 and prior to versions 16.10.17, 17.4.9, and 17.10.3, a potential path traversal vulnerability allow an attacker who manages to get a malicious WebJar extension installed on the wiki to write arbitrary files. While the consequences could be severe like overriding configuration files and setting the superadmin password, the attack first requires that the attacker already has admin access to at least a subwiki to be able to install a malicious extension. Further, the attacker needs to publish a malicious extension in an extension repository that is configured in the instance. This vulnerability has been patched in XWiki 16.10.17, 17.4.9, 17.10.3, and 18.0.0RC1. XWiki is not aware of any workarounds except for being careful whom developers grant script and admin rights to.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00651 51st percentileScored 2026-11-07
Fix Fixed xwiki-platform (xwiki): 16.10.17, 17.4.9, 17.10.3org.xwiki.platform:xwiki-platform-webjars-api (Maven): 16.10.17, 17.4.9, 17.10.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
XWikixwiki-platform9.6-rc-1 to before 16.10.17; 17.0.0-rc-1 to before 17.4.9; 17.5.0-rc-1 to before 17.10.316.10.17, 17.4.9, 17.10.3Patch availableCNA
—org.xwiki.platform:xwiki-platform-webjars-api (Maven)9.6-rc-1 to before 16.10.1716.10.17Patch availableGHSA-vgwr-23fq-pr7g
—org.xwiki.platform:xwiki-platform-webjars-api (Maven)17.0.0-rc-1 to before 17.4.917.4.9Patch availableGHSA-vgwr-23fq-pr7g
—org.xwiki.platform:xwiki-platform-webjars-api (Maven)17.5.0-rc-1 to before 17.10.317.10.3Patch availableGHSA-vgwr-23fq-pr7g
  • xwiki-platform VendorXWiki Affected 9.6-rc-1 to before 16.10.17; 17.0.0-rc-1 to before 17.4.9; 17.5.0-rc-1 to before 17.10.3 Fixed in 16.10.17, 17.4.9, 17.10.3 Patch available CNA
  • org.xwiki.platform:xwiki-platform-webjars-api (Maven) Vendor— Affected 9.6-rc-1 to before 16.10.17 Fixed in 16.10.17 Patch available GHSA-vgwr-23fq-pr7g
  • org.xwiki.platform:xwiki-platform-webjars-api (Maven) Vendor— Affected 17.0.0-rc-1 to before 17.4.9 Fixed in 17.4.9 Patch available GHSA-vgwr-23fq-pr7g
  • org.xwiki.platform:xwiki-platform-webjars-api (Maven) Vendor— Affected 17.5.0-rc-1 to before 17.10.3 Fixed in 17.10.3 Patch available GHSA-vgwr-23fq-pr7g

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*——XWiki
  • cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:* Versions — — ·XWiki

Remediation

  • Fix · CNA xwiki-platform (xwiki) Fixed in 16.10.17, 17.4.9, 17.10.3
  • Fix · GHSA-vgwr-23fq-pr7g org.xwiki.platform:xwiki-platform-webjars-api (Maven) Fixed in 16.10.17 Advisory →
  • Fix · GHSA-vgwr-23fq-pr7g org.xwiki.platform:xwiki-platform-webjars-api (Maven) Fixed in 17.4.9 Advisory →
  • Fix · GHSA-vgwr-23fq-pr7g org.xwiki.platform:xwiki-platform-webjars-api (Maven) Fixed in 17.10.3 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-48047
  2. 2026-10-03 Alias added: GHSA-vgwr-23fq-pr7g
  3. 2026-10-14 EPSS moved to the 50th–90th percentile

References

Other 4

  • TI-2025-18595 Remote code execution as guest via SolrSearchMacros request in xwiki KEVCVSS 3.1CRITICAL 9.8
  • TI-2023-25214 Remote code execution through the section parameter in Administration as guest in XWiki Platform CVSS 3.1CRITICAL 10.0
  • TI-2025-23500 XWiki Platform vulnerable to SQL injection through getdeleteddocuments.vm template sort parameter CVSS 4.0CRITICAL 9.3
  • TI-2025-23979 org.xwiki.platform:xwiki-platform-rest-server allows SQL injection in query endpoint of REST API CVSS 4.0CRITICAL 9.3
  • TI-2024-20829 XWiki Platform: Remote code execution from account via SearchSuggestSourceSheet CVSS 3.1CRITICAL 10.0
  • TI-2024-14375 XWiki Remote Code Execution vulnerability via user registration CVSS 3.1CRITICAL 10.0
See all 304 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences