{"id":"CVE-2025-55747","published":"2025-09-03T20:12:12Z","modified":"2025-09-03T20:48:27Z","title":"XWiki Platform's configuration files can be accessed through the webjars API","vendor":"xwiki","product":"xwiki-platform","tier":"core","eol":null,"affectedVersions":[{"vendor":"xwiki","product":"xwiki-platform","versions":[">= 6.1-milestone-2, < 16.10.7"]}],"description":{"text":"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions  6.1-milestone-2 through 16.10.6, configuration files are accessible through the webjars API. This is fixed in version 16.10.7.","provenance":"source","from":"CVE.org"},"summary":{"text":"The XWiki Platform (xwiki-platform, a generic wiki platform providing runtime services for applications built on it) has a relative path traversal flaw in its webjars API that exposes configuration files. An attacker with only network access can reach those configuration files directly, requiring no authentication, no privileges, and no user interaction, and no special configuration.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-31T05:10:41Z"},"cvss":{"score":9.3,"severity":"CRITICAL","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.01682,"percentile":0.76939,"date":"2026-10-30","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2025-12-15","exploitedFirstSeen":"2025-12-15","ransomware":false,"evidence":[{"url":"https://app.crowdsec.net/cti/cve-explorer/CVE-2025-55747","date":"2025-12-15"}],"evidenceTotal":1,"provenance":"source"},"exploited":true,"otx":{"pulseCount":0,"pulses":[],"provenance":"machine"},"cwes":[{"id":"CWE-23","name":"Relative Path Traversal"}],"references":[{"url":"https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-qww7-89xh-x7m7","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/xwiki/xwiki-platform/commit/9e7b4c03f2143978d891109a17159f73d4cdd318#diff-45ea9c87d5fb68cd5db0da7f78cf25e76f1325f5fe56e21618b21786fc706236R80-R81","tags":["x_refsource_MISC"]},{"url":"https://jira.xwiki.org/browse/XWIKI-19350","tags":["x_refsource_MISC"]}],"techniques":[],"reports":[],"affected":[{"ecosystem":"Maven","package":"org.xwiki.platform:xwiki-platform-webjars-api","vulnerableRanges":[">=7.1.4, <16.10.7",">=17.0.0-rc-1, <17.4.0-rc-1"],"patched":["16.10.7","17.4.0-rc-1"],"from":["GHSA-qww7-89xh-x7m7"],"provenance":"source"},{"ecosystem":"Maven","package":"org.xwiki.platform:xwiki-platform-webjars","vulnerableRanges":[">=6.1-miletone-2, <=7.1.3"],"patched":[],"from":["GHSA-qww7-89xh-x7m7"],"provenance":"source"}],"advisories":[{"id":"GHSA-qww7-89xh-x7m7","url":"https://github.com/advisories/GHSA-qww7-89xh-x7m7","severity":"CRITICAL","ecosystem":"Maven","package":"org.xwiki.platform:xwiki-platform-webjars-api","vulnerableRanges":[">=7.1.4, <16.10.7"],"patched":["16.10.7"],"provenance":"source","from":"GHSA"},{"id":"GHSA-qww7-89xh-x7m7","url":"https://github.com/advisories/GHSA-qww7-89xh-x7m7","severity":"CRITICAL","ecosystem":"Maven","package":"org.xwiki.platform:xwiki-platform-webjars-api","vulnerableRanges":[">=17.0.0-rc-1, <17.4.0-rc-1"],"patched":["17.4.0-rc-1"],"provenance":"source","from":"GHSA"},{"id":"GHSA-qww7-89xh-x7m7","url":"https://github.com/advisories/GHSA-qww7-89xh-x7m7","severity":"CRITICAL","ecosystem":"Maven","package":"org.xwiki.platform:xwiki-platform-webjars","vulnerableRanges":[">=6.1-miletone-2, <=7.1.3"],"patched":[],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2025-26642","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-26642","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"nuclei":[{"id":"CVE-2025-55747","name":"XWiki Platform - Information Disclosure","severity":"high","path":"http/cves/2025/CVE-2025-55747.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-55747.yaml"}],"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2025-09-03","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2025-55747","provenance":"source"},{"date":"2025-12-15","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://app.crowdsec.net/cti/cve-explorer/CVE-2025-55747","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":66.9,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":5.0,"detail":"added 320 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":15.39,"detail":"percentile 0.7694"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 nuclei template"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":6.51,"detail":"base score 9.3"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-xwiki-platform-cve-2022-29253","parents":[{"from":"CVE-2022-29253","to":"CVE-2025-55747","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/internal/template/InternalTemplateManager.java"],"commits":["https://github.com/xwiki/xwiki-platform/commit/4917c8f355717bb636d763844528b1fe0f95e8e2","https://github.com/xwiki/xwiki-platform/commit/9e7b4c03f2143978d891109a17159f73d4cdd318"],"basis":"rarely changed file"}]}],"packageHistory":[{"cve":"CVE-2025-55747","published":"2025-09-03","fixed":"17.4.0-rc-1","kev":false},{"cve":"CVE-2026-48047","published":"2026-08-07","fixed":"17.10.3","kev":false,"link":{"from":"CVE-2025-55747","to":"CVE-2026-48047","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.xwiki.platform:xwiki-platform-webjars-api","fromFixed":"16.10.7","toFixed":"16.10.17","daysApart":338},{"kind":"version-step","provenance":"source","package":"Maven:org.xwiki.platform:xwiki-platform-webjars-api","fromFixed":"17.4.0-rc-1","toFixed":"17.4.9","daysApart":338}]}}],"package":"Maven:org.xwiki.platform:xwiki-platform-webjars-api"}}