CVE-2026-34151

HIGHCVSS · not yet scored
—
EchelonGraph verdictMonitorLow exploitation likelihood right now — keep watching.
  • No CVSS published and no exploitation signals yet
CISA-KEV: Not listedEPSS PROB: —CVSS v2: —Exploit: None knownExposed: 0

No vendor fix yet — apply a workaround or compensating control (WAF / firewall / segmentation) and watch for a patch.

XWiki Platform Old Core: Resource path traversal via /skin/ action endpoint in Jetty 12+

Impact

With Jetty 12+ a user can craft a URL to access any resource the Jetty instance is allowed to access.

For example http://[host]/xwiki/bin/skin/..%252f/..%252f..%252f..%252f..%252f..%252f..%252f..%252fetc/passwd allows downloading the content of the /etc/passwd file, provided Jetty is allowed to read it, and if your XWiki webapp is located exactly 5 levels below / (like /var/lib/jetty/webapps/xwiki, which is the case in the docker image, for example).

Another example which does not go out of the XWiki webapp, but it's still a vulnerability (since users should not be allowed to access Hibernate or XWiki configuration files) is http://[host]/xwiki/bin/skin/..%252f/..%252fWEB-INF/xwiki.cfg.

Patches

This vulnerability has been patched in XWiki 17.10.5 and 18.2.0.

Workarounds

A possible workaround is to use a different application server, like Jetty < 12 (in the case of XWiki < 17) or Tomcat, which don't seem to be impacted.

Resources

* https://jira.xwiki.org/browse/XWIKI-24075 * https://jira.xwiki.org/browse/XCOMMONS-3594

For more information

If there are any questions or comments about this advisory: * Open an issue in Jira XWiki.org * Send an email to the Security Mailing List

Attribution

Lê Ngọc Khoa reported the vulnerability.

CVSS v3
—
EG Score
0.0(none)
EG Risk
0
EG Risk 0/100

EG Risk is EchelonGraph's 0–100 priority score. It fuses intrinsic severity with real-world exploitation and automatability, so you can rank equal-severity CVEs and fix the most dangerous first. Higher = act sooner. It is distinct from the 0–10 EG Score, which measures severity.

EPSS PROB
—
EPSS %ILE
—
KEV
Not listed

Published

July 7, 2026

Last Modified

July 7, 2026

Vendor Advisories for CVE-2026-34151(1)

These vendors published their own advisory mentioning this CVE — often with vendor-specific remediation steps + affected product lists not in NVD.

Affected Packages

(1 across 1 ecosystem)
Maven(1)
PackageVulnerable rangeFixed inDependents
org.xwiki.platform:xwiki-platform-oldcore—18.2.0—

Data Freshness Timeline

(refreshed 2× in last 7d / 3× in last 30d)

Each row is a source pipeline that fetched or updated this CVE on that date, with what changed. For example, "NVD update" means NVD published or revised its analysis for this CVE; "MITRE cvelistV5" means we ingested or refreshed it from the CNA feed. Most recent first.

  1. 2026-07-26 12:41 UTCEG score recompute
  2. 2026-07-23 03:09 UTCEG score recompute
  3. 2026-07-07 13:38 UTCEG score recompute

Frequently asked(3)

What is CVE-2026-34151?
CVE-2026-34151 is a high vulnerability published on July 7, 2026. XWiki Platform Old Core: Resource path traversal via /skin/ action endpoint in Jetty 12+ Impact With Jetty 12+ a user can craft a URL to access any resource the Jetty instance is allowed to access. For example…
When was CVE-2026-34151 disclosed?
CVE-2026-34151 was first published in the National Vulnerability Database on July 7, 2026. EchelonGraph re-ingests CVE updates from NVD on a 2-hour cycle, so this page reflects the latest published state.
How do I remediate CVE-2026-34151?
Patch to the fixed version published by the affected vendor. Where vendor advisories exist for CVE-2026-34151, EchelonGraph cross-links them in the Vendor Advisories panel below — those typically contain the canonical remediation steps, fixed version numbers, and any vendor-specific mitigations.

Dependency Blast Radius

See which npm, PyPI, Go, and Maven packages are affected by CVE-2026-34151

Explore →

Is Your Infrastructure Affected by CVE-2026-34151?

EchelonGraph automatically scans your cloud infrastructure and maps CVE exposure using blast radius analysis.

Start Free Scan →Browse All CVEs