PT-2025-35832 · Xwiki · Xwiki Platform

Gregor Neumann · Published 2025-09-03 · Updated 2026-01-16 · CVE-2025-55748

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions XWiki Platform versions 4.2-milestone-2 through 16.10.6

Description The XWiki Platform is a generic wiki platform. Configuration files are accessible through jsx and sx endpoints. An attacker can access and read configuration files using URLs such as http://localhost:8080/bin/ssx/Main/WebHome?resource=../../WEB-INF/xwiki.cfg&minify=false.

Recommendations Upgrade to version 16.10.7 or later.

Exploit

Fix

Relative Path Traversal

Weakness Enumeration

CWE-23

Related Identifiers

BDU:2025-13433

CVE-2025-55748

GHSA-M63C-3RMG-R2CF

Affected Products

Xwiki Platform

References · 18

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/55xxx/CVE-2025-55748.json · Exploit
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-m63c-3rmg-r2cf · Vendor Advisory
• https://github.com/xwiki/xwiki-platform/commit/9e7b4c03f2143978d891109a17159f73d4cdd318#diff-ee78930a9ac5ea586179fe8ab88a5fd58e369d175927d1e88a0b4dbc3ebcbf1eR62 · Patch
• https://osv.dev/vulnerability/CVE-2025-55748 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-55748 · Security Note
• https://jira.xwiki.org/browse/XWIKI-23109 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-m63c-3rmg-r2cf · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-13433 · Security Note
• https://github.com/xwiki/xwiki-platform · Note
• https://leakix.net/search?q=%2Bplugin%3AXWikiPlugin&scope=leak · Reddit Post
• https://twitter.com/CVEnew/status/1963343862958624866 · Twitter Post
• https://t.me/cveNotify/134246 · Telegram Post
• https://twitter.com/XavSecOps/status/2012226006891819349 · Twitter Post
• https://t.me/CVEtracker/31638 · Telegram Post
• https://twitter.com/Crowd_Security/status/1988584099645124946 · Twitter Post