XWiki Platform vulnerable to potential arbitrary file writing using path traversal from (subwiki) admin

CVE-2026-48047 View on GitHub ↗ View on CVE.org ↗ View on NVD ↗

Description

Impact

A potential path traversal vulnerability allow an attacker who manages to get a malicious WebJar extension installed on the wiki to write arbitrary files. While the consequences could be severe like overriding configuration files and setting the superadmin password, the attack first requires that the attacker already has admin access to at least a subwiki to be able to install a malicious extension. Further, the attacker needs to publish a malicious extension in an extension repository that is configured in the instance.

Patches

This vulnerability has been patched in XWiki 16.10.17, 17.4.9, 17.10.3, and 18.0.0RC1.

Workarounds

XWiki is not aware of any workarounds except for being careful whom developers grant script and admin rights to.

Resources

  • https://jira.xwiki.org/browse/XWIKI-23902
  • https://github.com/xwiki/xwiki-platform/commit/9f747fcd3200259a1de51957d3f5f6acc8e3816c

Basic information

Type
reviewed
Severity
medium
Advisory on GitHub
Open advisory ↗
Repository advisory
Open repository advisory ↗
Source code
Browse source ↗
Published (advisory)
2026-05-26 19:33:44 UTC
Updated
2026-05-26 19:33:44 UTC
GitHub reviewed
2026-05-26 19:33:44 UTC

EPSS Score

No EPSS score in this advisory JSON.

CVSS Scores

Base score Version Severity Vector
5.9 4.0 —
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N Click to expand
Attack vector (AV:N)
Could be attacked over the internet or any normal routed network.
Attack complexity (AC:L)
Exploitation conditions are straightforward and stable.
Attack requirements (AT:P)
Additional preconditions must be present for exploitation.
Privileges required (PR:H)
High privileges are required.
User interaction (UI:N)
No user interaction is required.
Vulnerable system confidentiality impact (VC:L)
Limited confidentiality impact on the vulnerable system.
Vulnerable system integrity impact (VI:H)
High integrity impact on the vulnerable system.
Vulnerable system availability impact (VA:L)
Limited availability impact on the vulnerable system.
Subsequent system confidentiality impact (SC:N)
No confidentiality impact on subsequent systems.
Subsequent system integrity impact (SI:N)
No integrity impact on subsequent systems.
Subsequent system availability impact (SA:N)
No availability impact on subsequent systems.

Identifiers

Type Value
GHSA GHSA-vgwr-23fq-pr7g ↗
CVE CVE-2026-48047 ↗

CWEs

CWE id Name
CWE-24 Path Traversal: '../filedir'

Affected packages (3)

Vulnerable version ranges and first patched releases as published by GitHub.

Ecosystem Package Vulnerable range First patched Vulnerable functions
maven org.xwiki.platform:xwiki-platform-webjars-api >= 9.6-rc-1, < 16.10.17 16.10.17 —
maven org.xwiki.platform:xwiki-platform-webjars-api >= 17.0.0-rc-1, < 17.4.9 17.4.9 —
maven org.xwiki.platform:xwiki-platform-webjars-api >= 17.5.0-rc-1, < 17.10.3 17.10.3 —

References

cvelogic Threat Intelligence