{"action":"Upgrade org.xwiki.platform:xwiki-platform-oldcore to 17.10.5 (17.x) or 18.2.0 (18.x) or later.","affected":[{"fixed":"17.10.5","introduced":"0"},{"fixed":"18.2.0","introduced":"18.0.0-rc-1"}],"component":"org.xwiki.platform:xwiki-platform-oldcore","cve_ids":["CVE-2026-34151"],"ecosystem":"Maven","epss":0.01062,"exploited":false,"fixed_versions":["17.10.5","18.2.0"],"ghsa_id":"GHSA-qj4x-9g63-25g6","id":"tcs_01M5N99NJS10K03Z4ZSTBFKWT2","modified_at":"2026-07-07T13:26:30.500387Z","published_at":"2026-07-07T13:01:21Z","references":["https://osv.dev/vulnerability/GHSA-qj4x-9g63-25g6","https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-qj4x-9g63-25g6","https://github.com/xwiki/xwiki-commons/pull/1675","https://github.com/xwiki/xwiki-platform","https://jira.xwiki.org/browse/XCOMMONS-3594","https://jira.xwiki.org/browse/XWIKI-24075"],"severity":{"label":"high"},"sources":[{"source":"osv","source_id":"GHSA-qj4x-9g63-25g6","url":"https://osv.dev/vulnerability/GHSA-qj4x-9g63-25g6"}],"summary":"XWiki Platform Old Core: Resource path traversal via /skin/ action endpoint in Jetty 12+"}