XWiki Platform Old Core Directory Traversal (CVE-2026-34151)

XWiki Platform Old Core Directory Traversal (CVE-2026-34151)

July 08, 2026

About the Vulnerability

Component Introduction

XWiki is an open-source enterprise wiki and collaborative application development platform developed by the XWiki community and XWiki SAS. It is mainly used for rapid deployment and centralized management in scenarios such as knowledge base management, team collaboration, enterprise internal portals, and custom web applications.

Vulnerability Description

On July 08, 2026, Sangfor FarSight Labs received notification of the directory traversal vulnerability in XWiki (CVE-2026-34151), classified as critical in threat level.

This vulnerability exists in the /bin/skin/ resource access endpoint. When XWiki is deployed in an environment running Jetty 12 or later, improper handling of double-encoded path traversal sequences at this endpoint allows an unauthenticated remote attacker to craft malicious requests and bypass path validation through double encoding. This enables the attacker to escape the restricted skin resource directory and read local files accessible with the permissions of the Jetty process. Successful exploitation of this vulnerability allows an attacker to read sensitive files on the server, resulting in sensitive information disclosure.

Affected Versions

The following XWiki versions are affected:

• XWiki Platform < 17.10.5
• 18.0.0-rc-1 ≤ XWiki Platform < 18.2.0

Solutions

Remediation Solutions

Official Solution

Upgrade to the following secure versions or later:

• XWiki Platform 17.10.5 or later
• XWiki Platform 18.2.0 or later

Workarounds

1. Disable unused functional modules to reduce attack entry points.
2. Follow the principle of least privilege to strictly control the scope of permissions for sensitive operations.
3. Do not expose services to the Internet unless necessary, to limit the access sources to trusted ranges.
4. Regularly update the system and components to secure versions so that known vulnerabilities can be patched at the earliest opportunity.

Sangfor Solutions

Proactive Vulnerability Detection

The following Sangfor service can proactively detect CVE-2026-34151 vulnerabilities and quickly identify vulnerability risks in batches in business scenarios:

• Athena Extended Detection and Response (XDR): The corresponding detection solution will be released on July 26, 2026. The rule ID is SF-2026-00937.

Timeline

On July 08, 2026, Sangfor FarSight Labs received notification of the XWiki Platform Old Core Directory Traversal (CVE-2026-34151).

On July 08, 2026, Sangfor FarSight Labs released a vulnerability alert.

Reference

XWiki Platform Old Core

Sangfor Farsight Labs is dedicated to tracking and analyzing global advanced threat landscapes. By leveraging its robust automated attribution and external monitoring systems, the lab delivers rapid, precise analysis and cross-correlation of APT attack samples. Having archived comprehensive profiles on dozens of APT and cybercrime entities, Farsight Labs has a proven track record of helping clients successfully mitigate high-stakes APT and cybercriminal incidents through expert incident response. In an era of escalating security conflicts and evolving TTPs, Sangfor’s Advanced Threat Team is committed to continuous vigilance and the rigorous research of new global security threats to ensure proactive defense.