CVE-2025-55747: XWiki Platform's configuration files can be accessed through the webjars API
Impact
It's possible to get access and read configuration files by using URLs such as http://localhost:8080/xwiki/webjars/wiki%3Axwiki/..%2F..%2F..%2F..%2F..%2FWEB-INF%2Fxwiki.cfg. The trick here is to encode the / which is decoded when parsing the URL segment, but not re-encoded when assembling the file path.
Patches
This has been patched in 17.4.0-rc-1, 16.10.7.
Workarounds
There is no known workaround, other than upgrading XWiki.
For more information
If you have any questions or comments about this advisory: Open an issue in Jira XWiki.org Email us at Security Mailing List
Other sources
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions 6.1-milestone-2 through 16.10.6, configuration files are accessible through the webjars API. This is fixed in version 16.10.7.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-55747?
CVE-2025-55747 is classified as a high severity vulnerability due to its potential to expose sensitive configuration files.
How do I fix CVE-2025-55747?
To fix CVE-2025-55747, update the affected software to version 16.10.7 or later of the xwiki-platform-webjars-api package.
What types of configuration files can be accessed through CVE-2025-55747?
CVE-2025-55747 can potentially allow unauthorized access to sensitive configuration files such as xwiki.cfg.
Which versions of XWiki are affected by CVE-2025-55747?
Versions of XWiki between 6.1-milestone-2 and 16.10.7 are affected by CVE-2025-55747.
What is the attack vector for CVE-2025-55747?
The attack vector for CVE-2025-55747 involves using specially crafted URLs to read configuration files.