CVE-2026-48047
1 advisory.
Maven/org.xwiki.platform:xwiki-platform-webjars-api CVE-2026-48047: medium
XWiki Platform vulnerable to potential arbitrary file writing using path traversal from (subwiki) admin
Action: Upgrade org.xwiki.platform:xwiki-platform-webjars-api to 16.10.17 (16.10.x), 17.4.9 (17.4.x) or 17.10.3 (17.10.x) or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 9.6-rc-1 | 16.10.17 | - |
| 17.0.0-rc-1 | 17.4.9 | - |
| 17.5.0-rc-1 | 17.10.3 | - |
Fixed versions
| 16.10.17 | 17.4.9 | 17.10.3 |
Sources
- osv: GHSA-vgwr-23fq-pr7g
- https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-vgwr-23fq-pr7g
- https://github.com/xwiki/xwiki-platform/commit/9f747fcd3200259a1de51957d3f5f6acc8e3816c
- https://github.com/xwiki/xwiki-platform
- https://jira.xwiki.org/browse/XWIKI-23902
CVE-2026-48047 · published · modified · JSON