# CVE-2026-34151: XWiki Platform - Path Traversal

> Live exploitation tracking for CVE-2026-34151 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2026-34151

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 8.2
- **Public exploit available:** Yes
- **Affected products:** XWiki Platform
- **Weaknesses:** CWE-24 (Path Traversal: '../filedir')
- **Tags:** wiki

## Description

XWiki Platform is a generic wiki platform. Prior to 17.10.5 and 18.2.0, the /skin/ action in com.xpn.xwiki.web.SkinAction can resolve double-encoded parent-directory segments outside the intended skin or web-application resource prefix when Jetty 12 or later decodes the request path. The affected lookup is replaced with Environment.getResourceAsStream(String, String), which constrains a resource to its expected prefix. An unauthenticated remote attacker can use the vulnerable behavior to read arbitrary resources permitted to the Jetty process, including WEB-INF/xwiki.cfg and, depending on deployment depth and operating-system permissions, host files. Tomcat and Jetty versions before 12 do not appear affected. This issue is fixed in versions 17.10.5 and 18.2.0.

## CrowdSec analysis

[CVE-2026-34151](https://euvd.enisa.europa.eu/vulnerability/CVE-2026-34151) is a path traversal vulnerability in XWiki Platform’s `/skin/` action when deployed with Jetty 12 or later, affecting versions before 17.10.5 and 18.2.0. An unauthenticated remote attacker can exploit double-encoded path segments to read resources accessible to the Jetty process, potentially including `WEB-INF/xwiki.cfg` and host files depending on deployment and permissions. Updating to a fixed version mitigates the risk.

CrowdSec has been tracking this vulnerability and its exploits since 30th of October 2026.

CrowdSec has not observed any significant exploitation activity targeting CVE-2026-34151 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Attackers target XWiki’s `/xwiki/bin/skin/` or `/bin/skin/` endpoints with double-encoded `../` path segments to traverse outside the intended resource directory. These requests may attempt to retrieve sensitive files such as `/etc/passwd`.

## Timeline

- 2026-09-14: CVE Published. CVE-2026-34151 is published to NVD.
- 2026-10-30: Rule Released. CrowdSec releases a rule to detect CVE-2026-34151 exploitation attempts against the CrowdSec Network.

## References

- https://github.com/xwiki/xwiki-platform/commit/79eba8655f3a96021a8e7ad07956e48d20a82383
- https://github.com/xwiki/xwiki-platform/releases/tag/xwiki-platform-18.2.0
- https://jira.xwiki.org/browse/XCOMMONS-3594
- https://github.com/xwiki/xwiki-platform/releases/tag/xwiki-platform-17.10.5
- https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-qj4x-9g63-25g6
- https://github.com/xwiki/xwiki-platform/commit/f7b33704083d3b4e45d1b9fc1e2cc33c66855f85
- https://github.com/xwiki/xwiki-commons/pull/1675
- https://jira.xwiki.org/browse/XWIKI-24075
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-34151.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2026-34151) follows observed exploitation activity for CVE-2026-34151. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.