CVE-2026-23734
CVE-2026-23734 is a critical-severity vulnerability with a CVSS 4.0 base score of 9.3. Its EPSS exploit-prediction score of 20% places it in the 97th percentile, indicating an elevated likelihood of exploitation. The underlying weakness is classified as CWE-23.
Key facts
- Severity: Critical (CVSS 4.0 base score 9.3)
- EPSS exploit prediction: 20% (97th percentile)
- Actively exploited: Not listed in CISA KEV
- EU (EUVD) id: EUVD-2026-31152
- Weakness: CWE-23
- Published:
- Last modified:
Description
XWiki Platform is a generic wiki platform. Versions prior to 18.1.0-rc-1, 17.10.3, 17.4.9, and 16.10.17 allow access to read configuration files by using URLs such as http://localhost:8080/bin/ssx/Main/WebHome?resource=/../../WEB-INF/xwiki.cfg&minify=false, leading to Path Traversal. The vulnerability is can be exploited via resources parameter the ssx and jsx endpoints by using leading slashes. This issue has been patched in 18.1.0-rc-1, 17.10.3, 17.4.9, 16.10.17.
Frequently asked questions
- What is CVE-2026-23734?
- XWiki Platform is a generic wiki platform. Versions prior to 18.1.0-rc-1, 17.10.3, 17.4.9, and 16.10.17 allow access to read configuration files by using URLs such as http://localhost:8080/bin/ssx/Main/WebHome?resource=/../../WEB-INF/xwiki.cfg&minify=false, leading to Path Traversal. The vulnerability is can be exploited via resources parameter the ssx and jsx endpoints by using leading slashes. This issue has been patched in 18.1.0-rc-1, 17.10.3, 17.4.9, 16.10.17.
- How severe is CVE-2026-23734?
- CVE-2026-23734 has a CVSS 4.0 base score of 9.3, rated critical severity.
- Is CVE-2026-23734 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 20% (97th percentile), an estimate of the probability of exploitation in the next 30 days.
- How do I fix CVE-2026-23734?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
- Does CVE-2026-23734 have an EU (EUVD) identifier?
- Yes. CVE-2026-23734 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-31152.
- When was CVE-2026-23734 published?
- CVE-2026-23734 was published on 2026-05-20 and last updated on 2026-06-17.
References
- https://github.com/xwiki/xwiki-commons/commit/a979cafd89f6a9c9c0b9ab19744d672df64429bf
- https://github.com/xwiki/xwiki-commons/security/advisories/GHSA-xq3r-2qv5-vqqm
- https://jira.xwiki.org/browse/XCOMMONS-3547
Other CWE-23 vulnerabilities
- CVE-2026-52813 — Critical (CVSS 10.0): Gogs is an open source self-hosted Git service. Prior to 0.14.3, organization names containing path traversal sequences…
- CVE-2026-8326 — Critical (CVSS 10.0): Path traversal vulnerability in Remote Spark (https://www.Remotespark.Com/) SparkView allows reading and writing…
- CVE-2026-33494 — Critical (CVSS 10.0): ORY Oathkeeper is an Identity & Access Proxy (IAP) and Access Control Decision API that authorizes HTTP requests based…
- CVE-2023-3941 — Critical (CVSS 10.0): Relative Path Traversal vulnerability in ZkTeco-based OEM devices allows an attacker to write any file on the system…
- CVE-2024-24578 — Critical (CVSS 10.0): RaspberryMatic is an open-source operating system for HomeMatic internet-of-things devices. RaspberryMatic / OCCU prior…
- CVE-2012-6069 — Critical (CVSS 10.0): The CoDeSys Runtime Toolkit’s file transfer functionality does not perform input validation, which allows an…