WaratekVRT Sign in

Xwiki-platform-webjars-api CVEs

2 CVEs, 1 exploited, 2 protected by Waratek

Reset
More filters (1)
Columns
Product xwiki-platform-webjars-api✕
Overview 2 matches · 1 exploited · 0 CISA KEV · 1 public PoC · 0 EPSS ≥ 0.5
2matches 1exploited50.0% 0CISA KEV0.0% 1public PoC50.0% 0EPSS ≥ 0.50.0%
Protected by Waratek 2 100.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0%
Critical 1 50.0% High 0 0.0% Medium 1 50.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 2 100.0% partly blocked 0 0.0% not blocked 0 0.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 1 50.0% Working exploit published 0 0.0% Proof of concept only 1 50.0% Forecast only 0 0.0% No public exploit 0 0.0%
split by peak 1 / month
Protected by Waratek: 2 Medium: 1Critical: 1 blocked by ARMR today: 2 Proof of concept only: 1Exploited: 1
Sep 251 Protected by Waratek1 Critical1 blocked by ARMR today1 Exploited1 Oct 250 Nov 250 Dec 250 Jan 260 Feb 260 Mar 260 Apr 260 May 260 Jun 260 Jul 260 Aug 261 Protected by Waratek1 Medium1 blocked by ARMR today1 Proof of concept only1
Sep 25Oct 25Nov 25Dec 25Jan 26Feb 26Mar 26Apr 26May 26Jun 26Jul 26Aug 26
2 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2026-48047 Medium 2026-08-07 Protected by Waratek Proof of concept only XWiki Platform WebJars API is a package for XWiki, a generic wiki platform. Starting with version 9.6-rc-1 and prior to versions 16.10.17, 17.4.9, and 17.10.3, a potential path traversal vulnerability allow an attacker who manages to get a malicious WebJar extension installed on the wiki to write arbitrary files. While the consequences could be severe like overriding configuration files and setting the superadmin password, the attack first requires that the attacker already has admin access to at least a subwiki to be able to install a malicious extension. Further, the attacker needs to publish a malicious extension in an extension repository that is configured in the instance. This vulnerability has been patched in XWiki 16.10.17, 17.4.9, 17.10.3, and 18.0.0RC1. XWiki is not aware of any workarounds except for being careful whom developers grant script and admin rights to.
CVE-2025-55747 Critical 2025-09-03 Protected by Waratek Exploited XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions 6.1-milestone-2 through 16.10.6, configuration files are accessible through the webjars API. This is fixed in version 16.10.7.