5.9

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-48047

CVE-2026-48047: XWiki Platform vulnerable to potential arbitrary file writing using path traversal from (subwiki) admin

Impact

A potential path traversal vulnerability allow an attacker who manages to get a malicious WebJar extension installed on the wiki to write arbitrary files. While the consequences could be severe like overriding configuration files and setting the superadmin password, the attack first requires that the attacker already has admin access to at least a subwiki to be able to install a malicious extension. Further, the attacker needs to publish a malicious extension in an extension repository that is configured in the instance.

Patches

This vulnerability has been patched in XWiki 16.10.17, 17.4.9, 17.10.3, and 18.0.0RC1.

Workarounds

XWiki is not aware of any workarounds except for being careful whom developers grant script and admin rights to.

Resources

https://jira.xwiki.org/browse/XWIKI-23902
https://github.com/xwiki/xwiki-platform/commit/9f747fcd3200259a1de51957d3f5f6acc8e3816c

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-48047

CVE-2026-48047:

5.9

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
org.xwiki.platform:xwiki-platform-webjars-api	maven	>= 9.6-rc-1, < 16.10.17	16.10.17
org.xwiki.platform:xwiki-platform-webjars-api	maven	>= 17.0.0-rc-1, < 17.4.9	17.4.9
org.xwiki.platform:xwiki-platform-webjars-api	maven	>= 17.5.0-rc-1, < 17.10.3	17.10.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists within the xwiki-platform-webjars-api component, specifically in the FilesystemResourceReferenceCopier class. The root cause is a path traversal vulnerability when handling resources from WebJar extensions. An attacker with administrative privileges on a subwiki could install a malicious WebJar extension containing specially crafted file paths.

The analysis of the patch 9f747fcd3200259a1de51957d3f5f6acc8e3816c reveals two key vulnerable functions:

org.xwiki.webjars.internal.FilesystemResourceReferenceCopier.copyResourceFromJAR: This function is the core of the vulnerability. It copies files from a JAR to the filesystem. Before the patch, it did not validate whether the destination path was within the intended export directory. By crafting a resource path with ../ sequences, an attacker could write files to arbitrary locations on the server's filesystem.
org.xwiki.webjars.internal.FilesystemResourceReferenceCopier.processCSSfile: This function acts as an entry point for the vulnerability. It parses CSS files within a WebJar, extracts resource URLs using url(), and then calls copyResourceFromJAR to place them on the filesystem. A malicious CSS file could contain a url() with a path traversal payload, which this function would then use to construct a malicious destination path, leading to the exploitation of the vulnerability in copyResourceFromJAR.

The patch mitigates this by adding path validation checks in both functions. In copyResourceFromJAR, it now verifies that the canonical path of the destination file is within the boundaries of the export directory. In processCSSfile, it checks that the resolved resource path starts with the expected prefix before attempting to copy it. Any runtime profiler monitoring file I/O operations during the installation of a malicious WebJar would see these function names in the stack trace leading up to the unauthorized file write.

Vulnerable functions

org.xwiki.webjars.internal.FilesystemResourceReferenceCopier.copyResourceFromJAR

xwiki-platform-core/xwiki-platform-webjars/xwiki-platform-webjars-api/src/main/java/org/xwiki/webjars/internal/FilesystemResourceReferenceCopier.java

This function is responsible for copying a resource from a JAR file to the filesystem. The vulnerability lies in the fact that it did not validate the `targetPath` parameter, which could be manipulated with `../` sequences to write a file outside of the intended export directory. This could be exploited by a malicious WebJar extension.

org.xwiki.webjars.internal.FilesystemResourceReferenceCopier.processCSSfile

xwiki-platform-core/xwiki-platform-webjars/xwiki-platform-webjars-api/src/main/java/org/xwiki/webjars/internal/FilesystemResourceReferenceCopier.java

This function parses CSS files for `url()` declarations to find and copy referenced resources. It was vulnerable because it would construct a resource path from the URL found in the CSS. A malicious CSS file could contain a `url()` with a path traversal payload (e.g., `url(../../../../file.txt)`), which would then be passed to the vulnerable `copyResourceFromJAR` method, leading to arbitrary file writing.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.