XWiki Platform is a generic wiki platform

#!/usr/bin/env python3
# check_cve_2026_23734.py
# Version-based verifier for CVE-2026-23734 in org.xwiki.commons:xwiki-commons-classloader-api
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import os
import re
import sys
from typing import Optional, Tuple, List, Set

TARGET_JAR_RE = re.compile(r"xwiki-commons-classloader-api-(.+)\.jar$")

COMMON_ROOTS = [
    "/var/lib/tomcat10/webapps/xwiki",
    "/var/lib/tomcat9/webapps/xwiki",
    "/var/lib/tomcat/webapps/xwiki",
    "/usr/share/xwiki",
    "/usr/lib/xwiki",
    "/opt/xwiki",
    os.getcwd(),
]

STAGE_RANK = {
    None: 3,          # final release
    "ga": 3,
    "final": 3,
    "release": 3,
    "rc": 2,
    "beta": 1,
    "b": 1,
    "alpha": 0,
    "a": 0,
    "milestone": -1,
    "m": -1,
}


def parse_version(v: str) -> Optional[Tuple[int, int, int, int, int]]:
    v = v.strip().lower()
    m = re.match(r"^(\d+)\.(\d+)(?:\.(\d+))?(?:-([a-z]+)-?(\d+)?)?$", v)
    if not m:
        return None
    major = int(m.group(1))
    minor = int(m.group(2))
    patch = int(m.group(3) or 0)
    stage = m.group(4)
    stage_num = int(m.group(5) or 0)
    if stage not in STAGE_RANK:
        return None
    return (major, minor, patch, STAGE_RANK[stage], stage_num)


def cmp_ver(a: str, b: str) -> Optional[int]:
    pa = parse_version(a)
    pb = parse_version(b)
    if pa is None or pb is None:
        return None
    return (pa > pb) - (pa < pb)


def ge(a: str, b: str) -> Optional[bool]:
    c = cmp_ver(a, b)
    return None if c is None else c >= 0


def lt(a: str, b: str) -> Optional[bool]:
    c = cmp_ver(a, b)
    return None if c is None else c < 0


def is_vulnerable(version: str) -> Optional[bool]:
    # Vendor advisory / JIRA fixed versions:
    # 16.10.17, 17.4.9, 17.10.3, 18.0.0-rc-1
    checks = [
        ("4.2-milestone-2", "16.10.17"),
        ("17.0.0-rc-1", "17.4.9"),
        ("17.5.0", "17.10.3"),
    ]
    for low, high in checks:
        g = ge(version, low)
        l = lt(version, high)
        if g is None or l is None:
            return None
        if g and l:
            return True

    # If version is >= first known fixed points in supported branches, treat as not vulnerable.
    # Also treats versions older than the introduced floor as not affected.
    known_bounds = ["4.2-milestone-2", "16.10.17", "17.0.0-rc-1", "17.4.9", "17.5.0", "17.10.3", "18.0.0-rc-1"]
    for bound in known_bounds:
        if cmp_ver(version, bound) is None:
            return None
    return False


def find_versions(roots: List[str]) -> Set[str]:
    found = set()
    for root in roots:
        if not os.path.exists(root):
            continue
        for dirpath, _, filenames in os.walk(root):
            for fn in filenames:
                m = TARGET_JAR_RE.match(fn)
                if m:
                    found.add(m.group(1))
    return found


def main() -> int:
    roots = sys.argv[1:] if len(sys.argv) > 1 else COMMON_ROOTS
    versions = find_versions(roots)

    if not versions:
        print("UNKNOWN - could not locate xwiki-commons-classloader-api JAR under: {}".format(", ".join(roots)))
        return 2

    vulnerable = []
    patched = []
    unknown = []

    for v in sorted(versions):
        status = is_vulnerable(v)
        if status is True:
            vulnerable.append(v)
        elif status is False:
            patched.append(v)
        else:
            unknown.append(v)

    if vulnerable:
        print("VULNERABLE - found affected xwiki-commons-classloader-api version(s): {}".format(", ".join(vulnerable)))
        if patched:
            print("INFO - also found non-vulnerable version(s): {}".format(", ".join(patched)))
        if unknown:
            print("INFO - unparsed version(s): {}".format(", ".join(unknown)))
        return 1

    if patched and not unknown:
        print("PATCHED - found non-vulnerable xwiki-commons-classloader-api version(s): {}".format(", ".join(patched)))
        return 0

    print("UNKNOWN - found version(s) but could not classify all of them. parsed-safe: {}; unparsed: {}".format(
        ", ".join(patched) if patched else "none",
        ", ".join(unknown) if unknown else "none"
    ))
    return 2


if __name__ == "__main__":
    sys.exit(main())