Attack Chain

1. Initial Access: An unauthenticated attacker sends an HTTP GET request to the vulnerable XWiki application's /xwiki/bin/skin/ endpoint.
2. Payload Crafting: The attacker embeds double URL-encoded path traversal sequences (..%252f) within the URL path following the /skin/ action.
3. Targeting Sensitive Files: The crafted URL aims to traverse directories to reach sensitive files, such as http://[host]/xwiki/bin/skin/..%252f/..%252f..%252f..%252f..%252f..%252f..%252f..%252fetc/passwd for system files or http://[host]/xwiki/bin/skin/..%252f/..%252fWEB-INF/xwiki.cfg for application configuration files.
4. Application Processing: The XWiki application, running on Jetty 12+, processes the request to the /skin/ endpoint.
5. Path Traversal Execution: Due to the vulnerability, Jetty 12+ misinterprets the encoded path traversal sequences, allowing the application to access resources outside its intended web application directory.
6. File Retrieval: The web server retrieves the content of the targeted file (e.g., /etc/passwd, xwiki.cfg) from the file system.
7. Data Disclosure: The server responds to the attacker with the contents of the sensitive file, revealing potentially critical system or application information.
8. Impact: This leads to information disclosure, which can be used for reconnaissance, identifying user accounts, understanding application architecture, or finding credentials for subsequent attacks.

Impact

Successful exploitation of CVE-2026-34151 can lead to severe information disclosure. Attackers can access any file on the server that the Jetty instance has read permissions for, including operating system files like /etc/passwd, revealing local user accounts and system configuration. More critically, it allows access to sensitive XWiki and Hibernate configuration files (e.g., xwiki.cfg), which often contain database connection strings, API keys, and other proprietary application settings. This information can be leveraged for further attacks, such as database compromise, privilege escalation, or lateral movement within the network. There are no reported victim counts, but any organization running affected XWiki versions on Jetty 12+ is at risk across all sectors.

Recommendation

• Patch CVE-2026-34151: Immediately upgrade XWiki Platform Old Core to version 17.10.5 or 18.2.0 or later to remediate CVE-2026-34151.
• Deploy Detection Rule: Deploy the provided Sigma rule "Detects CVE-2026-34151 Exploitation — XWiki Path Traversal" to your SIEM solution to identify attempts to exploit this vulnerability.
• Monitor Webserver Logs: Configure web server logging for HTTP requests to capture full URIs and query strings, specifically for unusual access patterns to the /xwiki/bin/skin/ endpoint containing ..%252f or similar encoded path traversal sequences.
• Implement Workarounds (if patching is not immediate): As a temporary measure, consider migrating XWiki to an application server other than Jetty 12+, such as Tomcat or an older version of Jetty (< 12), as these are not impacted by this specific vulnerability.