CrowdSecLive Exploit Tracker
Limited ExploitationCVE-2026-34151Public Exploit

XWiki Platform - Path Traversal (CVE-2026-34151)

PublishedSep 14, 2026
First SeenN/A
Last Seen
Reported
CVSS8.2
XWiki
XWikiXWiki Platform
wiki

Description

XWiki Platform is a generic wiki platform. Prior to 17.10.5 and 18.2.0, the /skin/ action in com.xpn.xwiki.web.SkinAction can resolve double-encoded parent-directory segments outside the intended skin or web-application resource prefix when Jetty 12 or later decodes the request path. The affected lookup is replaced with Environment.getResourceAsStream(String, String), which constrains a resource to its expected prefix. An unauthenticated remote attacker can use the vulnerable behavior to read arbitrary resources permitted to the Jetty process, including WEB-INF/xwiki.cfg and, depending on deployment depth and operating-system permissions, host files. Tomcat and Jetty versions before 12 do not appear affected. This issue is fixed in versions 17.10.5 and 18.2.0.

psychologyCrowdSec Analysis

CVE-2026-34151 is a path traversal vulnerability in XWiki Platform’s /skin/ action when deployed with Jetty 12 or later, affecting versions before 17.10.5 and 18.2.0. An unauthenticated remote attacker can exploit double-encoded path segments to read resources accessible to the Jetty process, potentially including WEB-INF/xwiki.cfg and host files depending on deployment and permissions. Updating to a fixed version mitigates the risk.

CrowdSec has been tracking this vulnerability and its exploits since 30th of October 2026.

CrowdSec has not observed any significant exploitation activity targeting CVE-2026-34151 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Attackers target XWiki’s /xwiki/bin/skin/ or /bin/skin/ endpoints with double-encoded ../ path segments to traverse outside the intended resource directory. These requests may attempt to retrieve sensitive files such as /etc/passwd.

lock

Full Intelligence Available

Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.

EventDate
CVE Published2026-09-14
Rule Released2026-10-30

Related Weaknesses

CWE-24: Path Traversal: '../filedir'

The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize "../" sequences that can resolve to a location that is outside of that directory.

arrow_forward

Remediation & Protection

lock to download blocklists, subscribe to firewalls, and access IP intelligence.

External References