Hi all!
I’m working with XWiki 18.7.0 on Ubuntu. Here what I see in the Global Administration: Security Vulnerabilities page:
But xwiki.properties reads:
rjr@e220i057h096l:~$ sudo grep -n "extension.security.scan.enabled" /etc/xwiki/xwiki.properties
666:# extension.security.scan.enabled = true
667:extension.security.scan.enabled = false
rjr@e220i057h096l:~$
catalina.out contains the following lines:
rjr@e220i057h096l:~$ sudo grep -iE "vulner|security.*scan|security.*index" /opt/tomcat/logs/catalina.out
2026-10-02 20:08:36,603 [Extension Security scanner] INFO s.i.ExtensionSecurityScheduler - Extension security scan disabled.
2026-10-03 20:08:36,606 [Extension Security scanner] INFO s.i.ExtensionSecurityScheduler - Extension security scan disabled.
rjr@e220i057h096l:~$
The documentation at Security Vulnerabilities Application (XWiki.org) says “When a value is not filled in the administration UI, the corresponding xwiki.properties value is used.”
But in this case the value is filled in the administration UI.
Any idea? Can you reproduce this behaviour?
I will set extension.security.scan.enabled to true, restart XWiki, and see and report what does happen.
Cheers!
