CVE-2026-48047 Overview
CVE-2026-48047 is a path traversal vulnerability [CWE-24] in the XWiki Platform WebJars API. The flaw affects XWiki versions from 9.6-rc-1 up to but not including 16.10.17, 17.4.9, and 17.10.3. An attacker who installs a malicious WebJar extension can write arbitrary files on the server. Successful exploitation can override configuration files and set the superadmin password. The attack requires admin access to at least a subwiki and the ability to publish a malicious extension in a configured extension repository.
Critical Impact
Arbitrary file write via malicious WebJar extension can lead to full XWiki instance compromise, including superadmin credential takeover.
Affected Products
- XWiki Platform WebJars API versions 9.6-rc-1 through 16.10.16
- XWiki Platform WebJars API 17.0.0 through 17.4.8
- XWiki Platform WebJars API 17.5.0 through 17.10.2
Discovery Timeline
- 2026-08-07 - CVE-2026-48047 published to NVD
- 2026-08-10 - Last updated in NVD database
Technical Details for CVE-2026-48047
Vulnerability Analysis
The XWiki Platform WebJars API packages client-side web libraries as JAR files for use within the wiki. The API extracts resources from WebJar archives and serves them to clients. The extraction logic does not properly validate resource paths contained within a WebJar. An attacker who controls the contents of a WebJar can craft entries with traversal sequences that escape the intended output directory. The result is arbitrary file write on the server hosting the wiki. Attackers can overwrite XWiki configuration files, replace application resources, or write files that grant superadmin access.
Root Cause
The root cause is improper sanitization of file paths when processing WebJar archive contents, mapped to [CWE-24] Path Traversal: '../filedir'. The API trusts path components from the WebJar package without normalizing them against the intended base directory before writing to disk.
Attack Vector
Exploitation is a multi-step process. The attacker first obtains admin rights on at least a subwiki. Next, the attacker publishes a malicious WebJar extension to an extension repository configured in the target instance. When the extension is installed, the vulnerable extraction routine writes attacker-controlled files outside the WebJars directory. The high privilege prerequisite limits the population of viable attackers to insiders or compromised admin accounts. Technical details are documented in the GitHub Security Advisory and XWiki Jira Issue XWIKI-23902.
Detection Methods for CVE-2026-48047
Indicators of Compromise
- Unexpected files written outside the standard WebJars directory on the XWiki server filesystem.
- Modifications to xwiki.cfg, xwiki.properties, or other core configuration files without a corresponding administrative change.
- Installation events for WebJar extensions sourced from unfamiliar or newly added extension repositories.
- Superadmin password changes not initiated by a known administrator.
Detection Strategies
- Audit XWiki extension installation logs for WebJar packages installed by non-standard admin accounts.
- Monitor filesystem integrity on directories outside the intended WebJars output path.
- Review the list of configured extension repositories for unauthorized additions.
Monitoring Recommendations
- Enable file integrity monitoring on XWiki configuration directories and web application roots.
- Alert on privilege changes to the superadmin account and on new admin grants at the wiki and subwiki level.
- Log and review all extension install, upgrade, and uninstall operations.
How to Mitigate CVE-2026-48047
Immediate Actions Required
- Upgrade XWiki to version 16.10.17, 17.4.9, 17.10.3, or 18.0.0RC1 or later.
- Review the list of accounts holding admin and script rights across all wikis and subwikis, and revoke unnecessary privileges.
- Restrict configured extension repositories to trusted sources only.
- Audit installed WebJar extensions and remove any of unknown provenance.
Patch Information
The vulnerability is patched in XWiki 16.10.17, 17.4.9, 17.10.3, and 18.0.0RC1. The fix is available in the GitHub commit 9f747fcd3200259a1de51957d3f5f6acc8e3816c. Administrators should apply the appropriate upgrade path for their deployment branch.
Workarounds
- No official workarounds exist beyond limiting who holds script and admin rights, per the XWiki advisory.
- Remove untrusted extension repositories from the instance configuration until the patch is applied.
- Enforce code review of any WebJar package before installation on production wikis.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
