CVE-2025-55748: XWiki Platform's configuration files can be accessed through jsx and sx endpoints
Impact
It's possible to get access and read configuration files by using URLs such as http://localhost:8080/bin/ssx/Main/WebHome?resource=../../WEB-INF/xwiki.cfg&minify=false.
This can apparently be reproduced on Tomcat instances.
Patches
This has been patched in 17.4.0-rc-1, 16.10.7.
Workarounds
There is no known workaround, other than upgrading XWiki.
For more information
If you have any questions or comments about this advisory: Open an issue in Jira XWiki.org Email us at Security Mailing List
Attribution
The vulnerability was reported by Gregor Neumann.
Other sources
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions 4.2-milestone-2 through 16.10.6, configuration files are accessible through jsx and sx endpoints. It's possible to access and read configuration files by using URLs such as http://localhost:8080/bin/ssx/Main/WebHome?resource=../../WEB-INF/xwiki.cfg&minify=false. This is fixed in version 16.10.7.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-55748?
CVE-2025-55748 is considered a high severity vulnerability due to the potential exposure of sensitive configuration files.
How do I fix CVE-2025-55748?
To fix CVE-2025-55748, upgrade to versions 17.4.0-rc-1 or 16.10.7 of the affected software.
What software is affected by CVE-2025-55748?
CVE-2025-55748 affects the org.xwiki.platform:xwiki-platform-skin-skinx package with specific versions.
Can CVE-2025-55748 be exploited on all Tomcat instances?
CVE-2025-55748 has been reported to be reproducible on Tomcat instances specifically configured to expose these resources.
What type of information can be accessed through CVE-2025-55748?
CVE-2025-55748 allows unauthorized access to read sensitive configuration files, such as xwiki.cfg.