Details
-
Bug
-
Resolution: Fixed
-
Blocker
-
18.2.0, 17.10.5
Description
After upgrading XWiki 17.10.4 to 17.10.5, XWiki is not able to start up. Using tomcat10 or tomcat11 (with the corresponding xwiki packages) produces the same result.
The following lines from catalina.out (see attachment) seem especially relevant:
[2026-04-02 13:45:00] [info] 2026-04-02 13:45:00,488 [main] WARN o.x.e.i.ServletEnvironment - The path [/WEB-INF/cache/infinispan/config.xml] is trying to access a resource outside of the resource root. [2026-04-02 13:45:04] [info] 2026-04-02 13:45:04,501 [main] WARN o.x.e.i.ServletEnvironment - The path [/WEB-INF/hibernate.cfg.xml] is trying to access a resource outside of the resource root. [2026-04-02 13:45:04] [info] 2026-04-02 13:45:04,502 [main] ERROR c.x.x.i.s.h.HibernateStore - Failed to find hibernate configuration file corresponding to path [/WEB-INF/hibernate.cfg.xml]
Attachments
Issue Links
- is caused by
-
XCOMMONS-3594 Make a lot easier to protect against resource path traversal
-
- Closed
-