The vulnerability is a path‑traversal flaw in the XWiki Platform’s ssx and jsx endpoints. It allows an attacker to craft a URL containing a leading slash in the resources parameter, resulting in the server reading arbitrary files outside the web application directory. One example is the configuration file xwiki.cfg, which may contain sensitive configuration data.

Affected products are the XWiki Platform, specifically the xwiki-commons module. Vulnerable releases are any versions prior to 18.1.0-rc-1, 17.10.3, 17.4.9, or 16.10.17.

The CVSS base score of 9.3 indicates a high‑severity issue, and the EPSS score of 20% signifies a moderate‑to‑high likelihood that the vulnerability will be exploited in the wild. The vulnerability is not listed in the CISA KEV catalog. While the CVE description does not state whether the ssx or jsx endpoint is publicly reachable, it is inferred that an attacker could send a crafted HTTP request to the endpoint where the resources parameter is available, thereby reading arbitrary files outside the web application directory.