Detections
Analytics

SCA: security update for org.xwiki.platform:xwiki-platform-webjars-api (GHSA-vgwr-23fq-pr7g)

medium Tenable Cloud Security Plugin ID 442361

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - XWiki Platform WebJars API is a package for XWiki, a generic wiki platform. Starting with version 9.6-rc-1
 and prior to versions 16.10.17, 17.4.9, and 17.10.3, a potential path traversal vulnerability allow an
 attacker who manages to get a malicious WebJar extension installed on the wiki to write arbitrary files.
 While the consequences could be severe like overriding configuration files and setting the superadmin
 password, the attack first requires that the attacker already has admin access to at least a subwiki to be
 able to install a malicious extension. Further, the attacker needs to publish a malicious extension in an
 extension repository that is configured in the instance. This vulnerability has been patched in XWiki
 16.10.17, 17.4.9, 17.10.3, and 18.0.0RC1. XWiki is not aware of any workarounds except for being careful
 whom developers grant script and admin rights to. (CVE-2026-48047)

Solution

Update the org.xwiki.platform:xwiki-platform-webjars-api library and its related packages to version 16.10.17 or later.

See Also

https://github.com/advisories/GHSA-vgwr-23fq-pr7g

Plugin Details

Severity: Medium

ID: 442361

Version: Revision 1.4

Type: Local

Family: SCA Checks

Published: 5/26/2026

Updated: 8/10/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.3

Percentile: 53.62

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: Medium

Base Score: 5

Temporal Score: 3.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS Score Source: CVE-2026-48047

CVSS v3

Risk Factor: Critical

Base Score: 9.1

Temporal Score: 7.9

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: Medium

Base Score: 5.9

Threat Score: 2.2

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 5/26/2026

Vulnerability Publication Date: 5/26/2026

Reference Information

CVE: CVE-2026-48047

cwe: CWE-24