[UPDATE] [medium] xwiki: Multiple vulnerabilities

mediumCVE-2026-48047 CVE-2026-48048

A remote, authenticated attacker can exploit multiple vulnerabilities in xwiki to manipulate files and disclose information.

CSIRTS triage

vendor: xwiki product: xwiki Path traversal Information disclosure

What: xwiki contains multiple vulnerabilities allowing authenticated users to manipulate files and disclose information.
Who is affected: All xwiki installations are affected.
Urgency: Medium priority; requires authentication but enables unauthorized file access.
Action: Apply patches for CVE-2026-48047 and CVE-2026-48048.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch xwiki

Get an email when a new xwiki advisory drops — max one per day, one-click unsubscribe.

Details

Source: CERT-Bund (BSI) Security Advisories (DE · national-cert · site)
Severity: medium
Published: 2026-08-11
Exploitation: Not in CISA KEV at last sync
Language: Machine-translated to English — verify against the original

Original advisory: https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-1645

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2026-480470.34% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 26% of all EPSS-scored CVEs.
Low exploitation riskCVE-2026-480480.36% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 29% of all EPSS-scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-48047	coverage & exploitation status	NVD · CVE.org
CVE-2026-48048	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

Recent advisories for xwiki

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

highGHSA-45ph-gxxr-gwgw: XWiki Platform Live Data Live Table Connector has privilege escalation from edit to scrip…ghsa · 2026-08-19
highCVE-2026-48048: XWiki Platform is a generic wiki platform. XWiki discovered that the patch for GHSA-5cf8-vrr8-…nvd · 2026-08-10
unknownCVE-2026-48047: XWiki Platform WebJars API is a package for XWiki, a generic wiki platform. Starting with vers…nvd · 2026-08-07
highGHSA-qj4x-9g63-25g6: XWiki Platform Old Core: Resource path traversal via /skin/ action endpoint in Jetty 12+ghsa · 2026-07-07
medium[NEW] [medium] xwiki: Vulnerability allows information disclosurecert-bund · 2026-07-07
highGHSA-h2xq-h7f9-vh6c: XWiki Blog Application home page vulnerable to Stored XSS via Post Titleghsa · 2026-03-04