CVE-2025-55747
published 2025-09-03CVE-2025-55747: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions 6.1-milestone-2 through 16.10.6…
PriorityP183critical9.1CVSS 3.1
AVNACLPRNUINSUCHIHAN
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
1.56%
72.1th percentile
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions 6.1-milestone-2 through 16.10.6, configuration files are accessible through the webjars API. This is fixed in version 16.10.7.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| xwiki | xwiki | — | — |
| xwiki | xwiki | 17.0.0 – 17.3.0 | — |
| xwiki | xwiki | >= 6.2 < 16.10.7 | 16.10.7 |
| xwiki | xwiki-platform | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →HTTP GET request to the webjars API endpoint with path traversal sequence targeting WEB-INF/xwiki.cfg; response body must contain all three strings: 'xwiki.editcomment=', 'xwiki.plugins=', and 'xwiki.encoding=' with HTTP 200 status. ↗
- →The exploit uses URL-encoded path traversal via the webjars API: 'wiki%3Axwiki/..%2F..%2F..%2F..%2F..%2FWEB-INF%2Fxwiki.cfg' to escape the webjar context and read configuration files. ↗
- →FOFA fingerprint query for identifying exposed XWiki Platform instances: app="XWIKI-Platform" ↗
- ·Affected versions are 6.1-milestone-2 through 16.10.6; version 16.10.7 and later are patched and not vulnerable. ↗
CVSS provenance
nvdv3.19.1CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
nvdv4.09.3CRITICALCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vulncheck9.3CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
XWiki configuration files can be accessed through the webjars API
ghsa·2025-09-03
CVE-2025-55747 [CRITICAL] CWE-23 XWiki configuration files can be accessed through the webjars API
XWiki configuration files can be accessed through the webjars API
### Impact
It's possible to get access and read configuration files by using URLs such as `http://localhost:8080/xwiki/webjars/wiki%3Axwiki/..%2F..%2F..%2F..%2F..%2FWEB-INF%2Fxwiki.cfg`. The trick here is to encode the / which is decoded when parsing the URL segment, but not re-encoded when assembling the file path.
### Patches
This has been patched in 17.4.0-rc-1, 16.10.7.
### Workarounds
There is no known workaround, other than upgrading XWiki.
### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Jira XWiki.org](https://jira.xwiki.org/)
* Email us at [Security Mailing List](mailto:[email protected])
OSV
XWiki configuration files can be accessed through the webjars API
osv·2025-09-03
CVE-2025-55747 [CRITICAL] XWiki configuration files can be accessed through the webjars API
XWiki configuration files can be accessed through the webjars API
### Impact
It's possible to get access and read configuration files by using URLs such as `http://localhost:8080/xwiki/webjars/wiki%3Axwiki/..%2F..%2F..%2F..%2F..%2FWEB-INF%2Fxwiki.cfg`. The trick here is to encode the / which is decoded when parsing the URL segment, but not re-encoded when assembling the file path.
### Patches
This has been patched in 17.4.0-rc-1, 16.10.7.
### Workarounds
There is no known workaround, other than upgrading XWiki.
### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Jira XWiki.org](https://jira.xwiki.org/)
* Email us at [Security Mailing List](mailto:[email protected])
VulnCheck
xwiki xwiki Relative Path Traversal
vulncheck·2025·CVSS 9.3
CVE-2025-55747 [CRITICAL] xwiki xwiki Relative Path Traversal
xwiki xwiki Relative Path Traversal
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions 6.1-milestone-2 through 16.10.6, configuration files are accessible through the webjars API. This is fixed in version 16.10.7.
Affected: xwiki xwiki
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://app.crowdsec.net/cti/cve-explorer/CVE-2025-55747
No detection rules found.
Nuclei
XWiki Platform - Information Disclosure
nuclei·CVSS 9.3
CVE-2025-55747 [CRITICAL] XWiki Platform - Information Disclosure
XWiki Platform - Information Disclosure
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions 6.1-milestone-2 through 16.10.6, configuration files are accessible through the webjars API.
Template:
id: CVE-2025-55747
info:
name: XWiki Platform - Information Disclosure
author: Redmomn
severity: high
description: |
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions 6.1-milestone-2 through 16.10.6, configuration files are accessible through the webjars API.
impact: |
Remote attackers can access sensitive configuration files, potentially exposing critical information.
remediation: |
Update to version 16.10.7 or later.
reference:
- https://jira.xwiki.org/browse/XWI
No writeups or analysis indexed.
2025-09-03
Published
Exploited in the wild