Patchfirst
Patchfirst
CVE-2025-55748 Public exploit Critical · 9.3 EPSS 1.8%

XWiki Platform's configuration files can be accessed through jsx and sx endpoints

xwiki · xwiki-platform

Summary

The flaw is a relative path traversal in the XWiki Platform (xwiki-platform) that lets configuration files be reached through its jsx and sx endpoints. An attacker who can send network requests to a vulnerable XWiki instance, with no authentication or user interaction required and no special configuration, can craft a request that reads files such as the application's configuration file.

Official description · CVE.org

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions 4.2-milestone-2 through 16.10.6, configuration files are accessible through jsx and sx endpoints. It's possible to access and read configuration files by using URLs such as `http://localhost:8080/bin/ssx/Main/WebHome?resource=../../WEB-INF/xwiki.cfg&minify=false`. This is fixed in version 16.10.7.

Breakdown
67.1 / 100
Exploited
Yes, in VulnCheck KEV
Reports
0
Tactics
0/15

First seen exploited 58 days after disclosure.

  1. Disclosedday 0
  2. First seen exploitedVulnCheck KEV evidence+58 days

See the family tree

3 related vulnerabilities in the same code over 3 years.

Same bug familyLinked by evidence that a fix failed or the same code was patched again. Oldest first.

  1. CVE-2022-29253Path Traversal in XWiki Platform25 May 2022
  2. relatedMedium

    Why these are linked:

    CVE-2025-55747XWiki Platform's configuration files can be accessed through the…3 Sep 2025
  3. same family
    This CVECVE-2025-55748XWiki Platform's configuration files can be accessed through jsx…3 Sep 2025

techniques

No techniques linked

No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

1 package in 1 ecosystem. Main package: org.xwiki.platform:xwiki-platform-skin-skinx.

Mavenorg.xwiki.platform:xwiki-platform-skin-skinxGHSA-m63c-3rmg-r2cf

Upgrade to 16.10.7 or later

Set the version to 16.10.7 or later in your pom.xml or build.gradle.

The first fix for CVE-2025-55748. No other CVE tracked by Patchfirst affects this package.

Affected versions

If you runUpgrade to
4.2-milestone-2 up to 16.10.716.10.7

“Up to” means the second version is the fix and is not affected.

Check your lockfile against all CVEs

What security researchers reported

Not named in any threat report yet

References

3 links, grouped by NVD tag

x_refsource_CONFIRM 1

github.com/xwiki/xwiki-platform/security/advisories/GHSA-m63c-3rmg-r2cf

x_refsource_MISC 2

github.com/xwiki/xwiki-platform/commit/9e7b4c03f2143978d891109a17159f73d4cdd318#diff-ee78930a9ac5ea586179fe8ab88a5fd58e369d175927d1e88a0b4dbc3ebcbf1eR62jira.xwiki.org/browse/XWIKI-23109
↑ ↓ chooseEnter openEsc close