{"id":"CVE-2025-55748","published":"2025-09-03T20:19:45Z","modified":"2025-09-03T20:47:51Z","title":"XWiki Platform's configuration files can be accessed through jsx and sx endpoints","vendor":"xwiki","product":"xwiki-platform","tier":"core","eol":null,"affectedVersions":[{"vendor":"xwiki","product":"xwiki-platform","versions":[">= 4.2-milestone-2, < 16.10.7"]}],"description":{"text":"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions 4.2-milestone-2 through 16.10.6, configuration files are accessible through jsx and sx endpoints. It's possible to access and read configuration files by using URLs such as `http://localhost:8080/bin/ssx/Main/WebHome?resource=../../WEB-INF/xwiki.cfg&minify=false`. This is fixed in version 16.10.7.","provenance":"source","from":"CVE.org"},"summary":{"text":"The flaw is a relative path traversal in the XWiki Platform (xwiki-platform) that lets configuration files be reached through its jsx and sx endpoints. An attacker who can send network requests to a vulnerable XWiki instance, with no authentication or user interaction required and no special configuration, can craft a request that reads files such as the application's configuration file.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-31T05:10:36Z"},"cvss":{"score":9.3,"severity":"CRITICAL","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.01771,"percentile":0.7812,"date":"2026-10-30","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2025-10-31","exploitedFirstSeen":"2025-10-31","ransomware":false,"evidence":[{"url":"https://app.crowdsec.net/cti/cve-explorer/CVE-2025-55748","date":"2025-10-31"}],"evidenceTotal":1,"provenance":"source"},"exploited":true,"otx":{"pulseCount":0,"pulses":[],"provenance":"machine"},"cwes":[{"id":"CWE-23","name":"Relative Path Traversal"}],"references":[{"url":"https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-m63c-3rmg-r2cf","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/xwiki/xwiki-platform/commit/9e7b4c03f2143978d891109a17159f73d4cdd318#diff-ee78930a9ac5ea586179fe8ab88a5fd58e369d175927d1e88a0b4dbc3ebcbf1eR62","tags":["x_refsource_MISC"]},{"url":"https://jira.xwiki.org/browse/XWIKI-23109","tags":["x_refsource_MISC"]}],"techniques":[],"reports":[],"affected":[{"ecosystem":"Maven","package":"org.xwiki.platform:xwiki-platform-skin-skinx","vulnerableRanges":[">=4.2-milestone-2, <16.10.7"],"patched":["16.10.7"],"from":["GHSA-m63c-3rmg-r2cf"],"provenance":"source"}],"advisories":[{"id":"GHSA-m63c-3rmg-r2cf","url":"https://github.com/advisories/GHSA-m63c-3rmg-r2cf","severity":"CRITICAL","ecosystem":"Maven","package":"org.xwiki.platform:xwiki-platform-skin-skinx","vulnerableRanges":[">=4.2-milestone-2, <16.10.7"],"patched":["16.10.7"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2025-26643","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-26643","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"nuclei":[{"id":"CVE-2025-55748","name":"XWiki Platform - Path Traversal","severity":"high","path":"http/cves/2025/CVE-2025-55748.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-55748.yaml"}],"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2025-09-03","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2025-55748","provenance":"source"},{"date":"2025-10-31","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://app.crowdsec.net/cti/cve-explorer/CVE-2025-55748","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":67.1,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":5.0,"detail":"added 365 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":15.62,"detail":"percentile 0.7812"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 nuclei template"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":6.51,"detail":"base score 9.3"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-xwiki-platform-cve-2022-29253","parents":[{"from":"CVE-2022-29253","to":"CVE-2025-55748","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/internal/template/InternalTemplateManager.java"],"commits":["https://github.com/xwiki/xwiki-platform/commit/4917c8f355717bb636d763844528b1fe0f95e8e2","https://github.com/xwiki/xwiki-platform/commit/9e7b4c03f2143978d891109a17159f73d4cdd318"],"basis":"rarely changed file"}]}]}}