An unauthenticated remote path traversal vulnerability in XWiki Platform allows unauthorized access to sensitive system files and configuration data, posing a high security risk.

This is a path traversal flaw (CWE-24) occurring within the SkinAction component. An unauthenticated attacker can exploit double-encoded directory segments to bypass resource prefixes, enabling the retrieval of restricted files such as WEB-INF/xwiki.cfg.

Successful exploitation allows an unauthenticated attacker to read sensitive configuration files and potentially host-level files, depending on the server environment. This exposure can lead to the compromise of administrative credentials, database connection strings, and other critical system information. With a CVSS score of 8.2, this vulnerability represents a significant risk to data confidentiality and infrastructure integrity.

Immediate Action: Upgrade XWiki Platform to version 17.10.5 or 18.2.0 immediately to apply the required fix to the resource lookup mechanism.

Proactive Monitoring: Monitor web server access logs for unusual requests containing double-encoded path segments or attempts to access files within the WEB-INF directory.

Compensating Controls: If an immediate upgrade is not possible, deploy a Web Application Firewall (WAF) to block requests containing suspicious character encoding or directory traversal patterns targeting the /skin/ endpoint.

Public Exploit Available: Unknown

Given the ability for unauthenticated attackers to exfiltrate sensitive configuration data, this vulnerability should be prioritized for immediate patching. Organizations running XWiki on Jetty 12 or later must upgrade to the provided fixed versions to prevent unauthorized file access and potential further system compromise.