CVE-2026-34151

XWiki Platform contains a path traversal flaw (CWE-24) in the /skin/ action handled by com.xpn.xwiki.web.SkinAction, fixed only in versions 17.10.5 and 18.2.0. When the wiki is deployed on Jetty 12 or later, double-encoded parent-directory segments in the request path are decoded by Jetty after XWiki's own check, letting the path escape the intended skin/webapp resource prefix. An unauthenticated remote attacker can exploit this with a simple crafted HTTP request to read arbitrary files readable by the Jetty process, including WEB-INF/xwiki.cfg (which holds database and other sensitive configuration) and, depending on deployment depth and OS permissions, host files. Only deployments running on Jetty 12+ are affected; Tomcat and Jetty versions before 12 do not appear vulnerable, and there is no known public PoC or in-the-wild exploitation. CVSS 4.0 is 8.2 (high) due to the network-exploitable, unauthenticated, high-impact read primitive.

What to do: Upgrade to XWiki Platform 17.10.5 or 18.2.0 immediately. If upgrading is not immediately possible, verify your servlet container: deployments on Tomcat or Jetty versions before 12 are not affected, and you can also block or normalize double-encoded traversal sequences (%252e%252e%252f-style) targeting the /skin/ endpoint at a reverse proxy or WAF. Review access logs for /skin/ requests containing encoded dot-dot segments and rotate any credentials or secrets found in xwiki.cfg if the instance was exposed.