CVE-2025-55748
published 2025-09-03CVE-2025-55748: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions 4.2-milestone-2 through 16.10.6…
PriorityP179high7.5CVSS 3.1
AVNACLPRNUINSUCHINAN
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
1.64%
73.4th percentile
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions 4.2-milestone-2 through 16.10.6, configuration files are accessible through jsx and sx endpoints. It's possible to access and read configuration files by using URLs such as `http://localhost:8080/bin/ssx/Main/WebHome?resource=../../WEB-INF/xwiki.cfg&minify=false`. This is fixed in version 16.10.7.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| xwiki | xwiki | — | — |
| xwiki | xwiki | 17.0.0 – 17.3.0 | — |
| xwiki | xwiki | >= 4.3 < 16.10.7 | 16.10.7 |
| xwiki | xwiki-platform | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Detect path traversal attempts against XWiki jsx/ssx endpoints by matching GET requests to /bin/ssx/ or /bin/jsx/ paths containing 'resource=' parameter with directory traversal sequences (../../) ↗
- →Successful exploitation responses will contain all three strings: 'xwiki.editcomment=', 'xwiki.plugins=', and 'xwiki.encoding=' in the response body with HTTP 200 status — use these as confirmation of sensitive config file disclosure
- →No authentication is required to exploit this vulnerability; monitor for unauthenticated GET requests to /bin/ssx/ or /bin/jsx/ endpoints with 'resource=' parameters containing traversal sequences
- ·The path traversal is exploitable via both 'jsx' and 'ssx' endpoints — scanning/detection rules should cover both /bin/jsx/ and /bin/ssx/ URL patterns, not just the ssx variant shown in the PoC ↗
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
nvdv4.09.3CRITICALCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vulncheck9.3CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
XWiki configuration files can be accessed through jsx and sx endpoints
osv·2025-09-03
CVE-2025-55748 [CRITICAL] XWiki configuration files can be accessed through jsx and sx endpoints
XWiki configuration files can be accessed through jsx and sx endpoints
### Impact
It's possible to get access and read configuration files by using URLs such as `http://localhost:8080/bin/ssx/Main/WebHome?resource=../../WEB-INF/xwiki.cfg&minify=false`.
This can apparently be reproduced on Tomcat instances.
### Patches
This has been patched in 17.4.0-rc-1, 16.10.7.
### Workarounds
There is no known workaround, other than upgrading XWiki.
### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Jira XWiki.org](https://jira.xwiki.org/)
* Email us at [Security Mailing List](mailto:[email protected])
### Attribution
The vulnerability was reported by Gregor Neumann.
GHSA
XWiki configuration files can be accessed through jsx and sx endpoints
ghsa·2025-09-03
CVE-2025-55748 [CRITICAL] CWE-23 XWiki configuration files can be accessed through jsx and sx endpoints
XWiki configuration files can be accessed through jsx and sx endpoints
### Impact
It's possible to get access and read configuration files by using URLs such as `http://localhost:8080/bin/ssx/Main/WebHome?resource=../../WEB-INF/xwiki.cfg&minify=false`.
This can apparently be reproduced on Tomcat instances.
### Patches
This has been patched in 17.4.0-rc-1, 16.10.7.
### Workarounds
There is no known workaround, other than upgrading XWiki.
### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Jira XWiki.org](https://jira.xwiki.org/)
* Email us at [Security Mailing List](mailto:[email protected])
### Attribution
The vulnerability was reported by Gregor Neumann.
VulnCheck
xwiki xwiki Relative Path Traversal
vulncheck·2025·CVSS 9.3
CVE-2025-55748 [CRITICAL] xwiki xwiki Relative Path Traversal
xwiki xwiki Relative Path Traversal
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions 4.2-milestone-2 through 16.10.6, configuration files are accessible through jsx and sx endpoints. It's possible to access and read configuration files by using URLs such as `http://localhost:8080/bin/ssx/Main/WebHome?resource=../../WEB-INF/xwiki.cfg&minify=false`. This is fixed in version 16.10.7.
Affected: xwiki xwiki
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://app.crowdsec.net/cti/cve-explorer/CVE-2025-55748; https://api.vulncheck.com/v3/index/vulncheck-canaries?cve=CVE-2025-55748&date=2025-
No detection rules found.
Nuclei
XWiki Platform - Path Traversal
nuclei·CVSS 9.3
CVE-2025-55748 [CRITICAL] XWiki Platform - Path Traversal
XWiki Platform - Path Traversal
XWiki Platform 4.2-milestone-2 through 16.10.6 contains a path traversal caused by improper access control in jsx and sx endpoints, letting remote attackers read configuration files, exploit requires no special privileges.
Template:
id: CVE-2025-55748
info:
name: XWiki Platform - Path Traversal
author: Redmomn
severity: high
description: |
XWiki Platform 4.2-milestone-2 through 16.10.6 contains a path traversal caused by improper access control in jsx and sx endpoints, letting remote attackers read configuration files, exploit requires no special privileges.
impact: |
Remote attackers can read sensitive configuration files, potentially exposing critical system information.
remediation: |
Upgrade to version 16.10.7 or later.
reference:
- https://github.co
2025-09-03
Published
Exploited in the wild