CVE-2025-55748 json
XWiki Platform's configuration files can be accessed through jsx and sx endpoints
published 2025-09-03 14 mo ago modified 2026-09-30 39 d ago also EUVD-2025-26643 , GHSA-m63c-3rmg-r2cf
- cvss
- 7.5
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.8%
- EPSS 1.8% chance of exploitation in 30 days, percentile 79%
- public exploits
- 0
- none known, plus a Nuclei check
Summary
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions 4.2-milestone-2 through 16.10.6, configuration files are accessible through jsx and sx endpoints. It's possible to access and read configuration files by using URLs such as `http://localhost:8080/bin/ssx/Main/WebHome?resource=../../WEB-INF/xwiki.cfg&minify=false`. This is fixed in version 16.10.7.
Patch / fix
- maven org.xwiki.platform:xwiki-platform-skin-skinx 16.10.7
- org.xwiki.platform xwiki-platform-skin-skinx 16.10.7
- xwiki xwiki 16.10.7
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 14 mo ago
Exploit prediction
1.84% chance of exploitation in the next 30 days, higher than 79% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- Nuclei template XWiki Platform - Path Traversal nuclei detection template
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 9.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
| CNA | 4.0 | 9.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.xwiki.platform:xwiki-platform-skin-skinx | >=4.2-milestone-2, <16.10.7 |
16.10.7 |
Affected products
- xwiki xwiki-platform
Classification
- Weakness
-
- CWE-23 Relative Path Traversal
References
-
github.com
/xwiki/xwiki-platform/commit/9e7b4c03f2143978d891109a17159f73d4cdd318#diff-ee78930a9ac5ea586179fe8ab88a5fd58e3
web, patch
-
github.com
/xwiki/xwiki-platform/security/advisories/GHSA-m63c-3rmg-r2cf
web, vendor-advisory
-
jira.xwiki.org
/browse/XWIKI-23109
web, issue-tracking, vendor-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2025-55748
advisory
-
github.com
/xwiki/xwiki-platform
package
Sources
- CVE List CVE-2025-55748
- GitHub Advisory GHSA-m63c-3rmg-r2cf
- NVD CVE-2025-55748
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.