PT-2025-35831 · Xwiki · Xwiki Platform

Tmortagne · CVE-2025-55747 · Published 2025-09-03 · Updated 2025-10-17

Positive Technologies (AI Summary)

CVSS v3.1

9.4

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions XWiki Platform versions 6.1-milestone-2 through 16.10.6

Description The XWiki Platform is a generic wiki platform. Affected versions allow access to configuration files through the webjars API. This issue is resolved in version 16.10.7.

Recommendations Update to version 16.10.7 or later.

Exploit

Fix

DoS

Relative Path Traversal

Weakness Enumeration

CWE-23

Related Identifiers

BDU:2025-13434

CVE-2025-55747

GHSA-QWW7-89XH-X7M7

Affected Products

Xwiki Platform

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/55xxx/CVE-2025-55747.json · Exploit
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-qww7-89xh-x7m7 · Vendor Advisory
• https://github.com/xwiki/xwiki-platform/commit/9e7b4c03f2143978d891109a17159f73d4cdd318#diff-45ea9c87d5fb68cd5db0da7f78cf25e76f1325f5fe56e21618b21786fc706236R80-R81 · Patch
• https://osv.dev/vulnerability/GHSA-qww7-89xh-x7m7 · Vendor Advisory
• https://jira.xwiki.org/browse/XWIKI-19350 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-55747 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-55747 · Security Note
• https://bdu.fstec.ru/vul/2025-13434 · Security Note
• https://github.com/xwiki/xwiki-platform · Note
• https://t.me/CVEtracker/31637 · Telegram Post
• https://twitter.com/CVEnew/status/1963343863914938387 · Twitter Post
• https://twitter.com/CCBalert/status/1963701616931914064 · Twitter Post
• https://twitter.com/pdnuclei_bot/status/1979095077210202301 · Twitter Post
• https://t.me/cveNotify/134245 · Telegram Post
• https://twitter.com/offseq/status/1963437181281677654 · Twitter Post