PT-2025-35831 · Xwiki · Xwiki Platform

Tmortagne · Published 2025-09-03 · Updated 2025-10-17 · CVE-2025-55747

Positive Technologies (AI Summary)

CVSS v2.0

9.4

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions XWiki Platform versions 6.1-milestone-2 through 16.10.6

Description The XWiki Platform is a generic wiki platform. Affected versions allow access to configuration files through the webjars API. This issue is resolved in version 16.10.7.

Recommendations Update to version 16.10.7 or later.

Exploit

Fix

Relative Path Traversal

Weakness Enumeration

CWE-23

Related Identifiers

BDU:2025-13434

CVE-2025-55747

GHSA-QWW7-89XH-X7M7

Affected Products

Xwiki Platform

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/55xxx/CVE-2025-55747.json · Exploit
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-qww7-89xh-x7m7 · Vendor Advisory
• https://github.com/xwiki/xwiki-platform/commit/9e7b4c03f2143978d891109a17159f73d4cdd318#diff-45ea9c87d5fb68cd5db0da7f78cf25e76f1325f5fe56e21618b21786fc706236R80-R81 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-55747 · Security Note
• https://osv.dev/vulnerability/CVE-2025-55747 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-qww7-89xh-x7m7 · Vendor Advisory
• https://jira.xwiki.org/browse/XWIKI-19350 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-13434 · Security Note
• https://github.com/xwiki/xwiki-platform · Note
• https://twitter.com/offseq/status/1963437181281677654 · Twitter Post
• https://t.me/CVEtracker/31637 · Telegram Post
• https://twitter.com/pdnuclei_bot/status/1979095077210202301 · Twitter Post
• https://twitter.com/CVEnew/status/1963343863914938387 · Twitter Post
• https://t.me/cveNotify/134245 · Telegram Post
• https://twitter.com/CCBalert/status/1963701616931914064 · Twitter Post