CVE-2026-34151: XWiki Platform: Resource path traversal via /skin/ action endpoint in Jetty 12+

Is it exploited?

Not on CISA's list. CISA has not added it to the Known Exploited Vulnerabilities catalog as of 30 Oct 2026. If CISA adds it, this page shows it as known exploited.

How likely is exploitation in the next 30 days?

2.5%

Up from 1.1% on 24 Oct 2026.

EPSS score, percentile 84.5 of all scored records. A probability estimated by FIRST, not a report of exploitation.

How severe?

8.2 High

CVSS v4.0 base score, given by the CNA

What should I do?

CISA has set no required action, because the vulnerability is not in KEV.

The CVE record links no vendor advisory, patch or mitigation.

Which versions are affected?

Affected

• < 17.10.5
• >= 18.0.0-rc-1, < 18.2.0

Versions by product

Source: CISA KEV 2026.10.30, as of 30 Oct 2026; FIRST EPSS, as of 31 Oct 2026; CVE List, as of 31 Oct 2026. About the data.

Description

XWiki Platform: Resource path traversal via /skin/ action endpoint in Jetty 12+

XWiki Platform is a generic wiki platform. Prior to 17.10.5 and 18.2.0, the /skin/ action in com.xpn.xwiki.web.SkinAction can resolve double-encoded parent-directory segments outside the intended skin or web-application resource prefix when Jetty 12 or later decodes the request path. The affected lookup is replaced with Environment.getResourceAsStream(String, String), which constrains a resource to its expected prefix. An unauthenticated remote attacker can use the vulnerable behavior to read arbitrary resources permitted to the Jetty process, including WEB-INF/xwiki.cfg and, depending on deployment depth and operating-system permissions, host files. Tomcat and Jetty versions before 12 do not appear affected. This issue is fixed in versions 17.10.5 and 18.2.0.

Source: CVE List, as of 31 Oct 2026. About the data.

What to do

Advisories and patches

The CVE record links no vendor advisory, patch or mitigation.

This summary is based on the CVE record as of 31 Oct 2026. Check the vendor's advisory before you act: affected versions and fixes can change.

Affected products and versions

Source: CVE List, as of 31 Oct 2026. About the data.

Timeline

Known exploited XWiki vulnerabilities

• CVE-2025-24893: XWiki Platform Eval Injection Vulnerability (added 30 Oct 2025)