Path traversal in xwiki-platform-skin-skinx

published 2022-02-09 4 y ago modified 2026-06-17 4 mo ago also GHSA-7ph6-5cmq-xgjq , EUVD-2022-0891

cvss: 6.8; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 1.0%; EPSS 1.0% chance of exploitation in 30 days, percentile 61%
public exploits: 0; none known

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions AbstractSxExportURLFactoryActionHandler#processSx does not escape anything from SSX document references when serializing it on filesystem, it is possible to for the HTML export process to contain reference elements containing filesystem syntax like "../", "./". or "/" in general. The referenced elements are not properly escaped. This issue has been resolved in version 13.6-rc-1. This issue can be worked around by limiting or disabling document export.

Patch / fix

fixed in 1 links 2

maven org.xwiki.platform:xwiki-platform-skin-skinx 13.6

github.com/xwiki/xwiki-platform@ab77825 commit
jira.xwiki.org/browse/XWIKI-18819 advisory

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 18 mo ago (2025-04-23)

Exploit prediction

0.96% chance of exploitation in the next 30 days, higher than 61% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	6.8	CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:H
NVD	3.1	5.4	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
NVD	2.0	5.8	AV:N/AC:M/Au:N/C:P/I:P/A:N
GitHub	3.1	6.8	CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:H

Affected packages

ecosystem	package	affected	fixed in
maven	org.xwiki.platform:xwiki-platform-skin-skinx	>=6.2-rc-1, <13.6	13.6

Affected products

xwiki xwiki-platform

Classification

Weakness

CWE-22 Improper Limitation of a Pathname to a Restricted Directory
CWE-116 Improper Encoding or Escaping of Output

References

github.com /xwiki/xwiki-platform/commit/ab778254fb8f71c774e1c1239368c44fe3b6bba5
web, patch, third-party-advisory
jira.xwiki.org /browse/XWIKI-18819
web, patch, vendor-advisory
github.com /xwiki/xwiki-platform/security/advisories/GHSA-7ph6-5cmq-xgjq
web, third-party-advisory
nvd.nist.gov /vuln/detail/CVE-2022-23620
advisory
github.com /xwiki/xwiki-platform
package

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary