CVE-2026-48047 xwiki CVE debrief

Who should care

Defenders responsible for XWiki instances, especially those with admin access granted to users or scripts, should assess exposure and apply patches or workarounds to prevent potential path traversal attacks.

Why it matters

Defenders should prioritize verifying exposure in XWiki instances, especially those with admin access granted to users or scripts, and apply patches or workarounds to prevent potential path traversal attacks. The attack requires admin access to a subwiki and publication of a malicious extension in a configured repository. Patched versions are available, but the exact scope of affected instances remains unknown.

• Potential arbitrary file writing with admin access.
• Possible configuration file override and superadmin password reset.
• Required verification of XWiki instance exposure and patch application.
• Potential for malicious extension installation and exploitation.

Technical summary

The XWiki Platform WebJars API is vulnerable to a path traversal attack, allowing an attacker with admin access to a subwiki to write arbitrary files by installing a malicious WebJar extension. The attacker must publish the malicious extension in a configured extension repository. This vulnerability has been patched in XWiki 16.10.17, 17.4.9, 17.10.3, and 18.0.0RC1. The attack requires careful planning and execution, including gaining admin access to a subwiki and publishing a malicious extension, highlighting the importance of restricting admin access and monitoring extension installations.

Defensive priority

Defenders should prioritize verifying exposure in XWiki instances, especially those with admin access granted to users or scripts, and apply patches or workarounds.

Recommended defensive actions

• Verify XWiki instance exposure, especially for admin access granted to users or scripts.
• Apply patches or workarounds to prevent potential path traversal attacks.
• Monitor extension repository configurations for suspicious activity.
• Restrict admin access to subwikis and extension installation.
• Implement additional logging and monitoring for WebJar extension installations.
• Conduct regular security audits to identify and address potential vulnerabilities.
• Review and update incident response plans to include procedures for handling potential path traversal attacks.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, affected versions, and patched versions. However, the exact scope of affected instances and the number of potential targets remain unknown.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.