The flaw is a path‑traversal vulnerability in the XWiki Platform’s ssx and jsx endpoints, allowing an attacker to craft a URL containing a leading slash in the resources parameter and read arbitrary files outside the web application directory. This enables remote disclosure of sensitive configuration files such as xwiki.cfg, potentially revealing credentials and other confidential data, thereby compromising the confidentiality of the system.

Affected products are the XWiki Platform, specifically the xwiki‑commons module. Vulnerable releases are any versions prior to 18.1.0‑rc‑1, 17.10.3, 17.4.9, or 16.10.17. These legacy releases may still be deployed in production environments.

The CVSS base score of 9.3 indicates a high‑severity issue, with no EPSS value and no listing in the CISA KEV catalog. The vulnerability can be exploited with low complexity by sending a crafted HTTP request to a publicly exposed ssx or jsx endpoint; the attack does not require authentication or privileged access, so the risk is significant for any publicly reachable instance of the affected XWiki Platform versions.