{"action":"Upgrade org.xwiki.commons:xwiki-commons-classloader-api to 16.10.17 (16.10.x), 17.4.9 (17.4.x), 17.10.3 (17.10.x) or 18.1.0-rc-1 (18.1.x) or later.","affected":[{"fixed":"16.10.17","introduced":"4.2-milestone-2"},{"fixed":"17.4.9","introduced":"17.0.0-rc-1"},{"fixed":"17.10.3","introduced":"17.5.0"},{"fixed":"18.1.0-rc-1","introduced":"18.0.0-rc-1"}],"component":"org.xwiki.commons:xwiki-commons-classloader-api","cve_ids":["CVE-2026-23734"],"ecosystem":"Maven","epss":0.18528,"exploited":false,"fixed_versions":["16.10.17","17.4.9","17.10.3","18.1.0-rc-1"],"ghsa_id":"GHSA-xq3r-2qv5-vqqm","id":"tcs_01M5N9JS5FKBBZ1HVGEVNE18B6","modified_at":"2026-05-26T17:41:29.454929Z","published_at":"2026-05-26T17:16:40Z","references":["https://osv.dev/vulnerability/GHSA-xq3r-2qv5-vqqm","https://github.com/xwiki/xwiki-commons/security/advisories/GHSA-xq3r-2qv5-vqqm","https://nvd.nist.gov/vuln/detail/CVE-2026-23734","https://github.com/xwiki/xwiki-commons/commit/a979cafd89f6a9c9c0b9ab19744d672df64429bf","https://github.com/xwiki/xwiki-commons","https://jira.xwiki.org/browse/XCOMMONS-3547"],"severity":{"label":"critical","score":9.3},"sources":[{"source":"osv","source_id":"GHSA-xq3r-2qv5-vqqm","url":"https://osv.dev/vulnerability/GHSA-xq3r-2qv5-vqqm"},{"source":"nvd","source_id":"CVE-2026-23734","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23734"}],"summary":"XWiki Platform has path traversal via resources parameter in ssx and jsx endpoints when using leading slash"}