CVE-2026-48047: 
Java vulnerability analysis and mitigation

CVE-2026-48047 is a path traversal vulnerability in the XWiki Platform's WebJar extension handling that allows an attacker with subwiki admin access to write arbitrary files to the server filesystem. It affects the Maven package org.xwiki.platform:xwiki-platform-webjars-api in versions >= 9.6-rc-1 < 16.10.17, >= 17.0.0-rc-1 < 17.4.9, and >= 17.5.0-rc-1 < 17.10.3. The vulnerability was published on May 21, 2026, and added to the GitHub Advisory Database on May 26, 2026. It carries a CVSS v4 base score of 5.9 (Medium/Moderate) (GitHub Advisory, XWiki Advisory).

The root cause is CWE-24 (Path Traversal: '../filedir') — the FilesystemResourceReferenceCopier class in the xwiki-platform-webjars-api module failed to validate that file paths extracted from WebJar archives (JAR files) remained within the intended export directory. Specifically, the code did not perform canonical path comparison before writing extracted resources, and also failed to validate relative URLs found in CSS files within WebJars against the expected resource prefix. An attacker crafts a malicious WebJar extension containing entries with path traversal sequences (e.g., ../../../../file.txt) or CSS files referencing such paths, then installs it on a subwiki they administer. The fix (commit 9f747fc) adds canonical path checks to ensure extracted files resolve within the export directory, and validates that CSS-referenced resource names start with the expected prefix before copying (GitHub Commit, XWiki Advisory).

Successful exploitation allows an attacker to write arbitrary files anywhere on the server filesystem that the XWiki process has write access to. The most severe consequences include overwriting XWiki configuration files and resetting the superadmin password, which could lead to full platform takeover. Integrity impact is rated High, with low confidentiality and availability impacts on the vulnerable system (GitHub Advisory).

Exploitation requires the attacker to already hold admin privileges on at least one subwiki and to be able to publish a malicious extension to an extension repository configured in the target XWiki instance — making this a high-privilege, multi-step attack. No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported. The CVE status is currently "Reserved" and it is not listed in the CISA KEV catalog. No EPSS score is currently available (GitHub Advisory, XWiki Advisory).

1. Gain subwiki admin access: Obtain or already possess admin rights on at least one subwiki within the target XWiki instance (e.g., through a legitimate account or social engineering).
2. Craft a malicious WebJar: Create a JAR file containing entries with path traversal sequences in their names (e.g., webjars/malicious/1.0/../../../../conf/xwiki.cfg) or a CSS file with url() references pointing outside the expected prefix (e.g., .x { background: url("../../../../conf/xwiki.cfg"); }).
3. Package as an XWiki extension: Wrap the malicious JAR as a valid XWiki extension (e.g., a Maven artifact with appropriate pom.xml metadata).
4. Publish to a configured repository: Upload the malicious extension to an extension repository that is already configured and trusted by the target XWiki instance.
5. Install the extension: Using subwiki admin privileges, install the malicious extension on the subwiki via the XWiki Extension Manager.
6. Trigger file extraction: Initiate an action that causes XWiki to process the WebJar (e.g., a filesystem export), causing the FilesystemResourceReferenceCopier to extract JAR entries without proper path validation.
7. Achieve arbitrary file write: The traversal sequences cause files to be written outside the intended export directory — for example, overwriting xwiki.cfg to reset the superadmin password and gain full platform control (GitHub Commit, XWiki Advisory).

• Logs: XWiki application logs containing warnings such as Skipping copying of resource [...] since it is outside of the export directory or Possible path traversal attempt (these are emitted by the patched version; their absence on unpatched systems means traversal may succeed silently).
• File System: Unexpected or modified files outside the XWiki export/webjar directory, particularly in configuration directories (e.g., xwiki.cfg, xwiki.properties with unexpected modification timestamps); newly created files in parent directories of the export path.
• Extension Manager: Presence of unfamiliar or externally sourced WebJar extensions installed on subwikis, especially those not originating from official XWiki repositories.
• Process/Application: Unexpected changes to superadmin credentials or configuration values shortly after extension installation events (GitHub Commit).

XWiki has released patches in versions 16.10.17, 17.4.9, 17.10.3, and 18.0.0RC1. Administrators should upgrade to one of these versions as the primary remediation. No technical workarounds are available; XWiki's only guidance is to carefully control who is granted script and admin rights on subwikis, limiting the pool of users who could install malicious extensions (XWiki Advisory, GitHub Advisory).