CVE-2025-55749 json
The XWiki Jetty package (XJetty) allows accessing any application file through URL
published 2025-12-01 11 mo ago modified 2026-09-26 44 d ago also EUVD-2025-200075 , GHSA-53gx-j3p6-2rw9
- cvss
- 7.5
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.6%
- EPSS 1.6% chance of exploitation in 30 days, percentile 75%
- public exploits
- 0
- none known, plus a Nuclei check
Summary
XWiki is an open-source wiki software platform. From 16.7.0 to 16.10.11, 17.4.4, or 17.7.0, in an instance which is using the XWiki Jetty package (XJetty), a context is exposed to statically access any file located in the webapp/ folder. It allows accessing files which might contains credentials. Fixed in 16.10.11, 17.4.4, and 17.7.0.
Patch / fix
- maven org.xwiki.platform:xwiki-platform-tool-jetty-resources 16.10.11, 17.4.4, 17.7.0
- org.xwiki.platform xwiki-platform-tool-jetty-resources 16.10.11, 17.4.4, 17.7.0
- xwiki xwiki 16.10.11, 17.4.4, 17.7.0
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 11 mo ago
Exploit prediction
1.58% chance of exploitation in the next 30 days, higher than 75% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- Nuclei template XWiki - Information Disclosure nuclei detection template
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 8.7 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N |
| GitHub | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| CNA | 4.0 | 8.7 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.xwiki.platform:xwiki-platform-tool-jetty-resources | >=16.7.0, <16.10.11 >=17.0.0-rc-1, <17.4.4 >=17.5.0, <17.7.0 |
16.10.11 17.4.4 17.7.0 |
Affected products
- xwiki xwiki-platform
Classification
- Weakness
-
- CWE-284 Improper Access Control
References
-
github.com
/xwiki/xwiki-platform/commit/42fb063749dd88cc78196f72d7318b7179285ebd
web, patch
-
github.com
/xwiki/xwiki-platform/commit/99a04a0e2143583f5154a43e02174155da7e8e10
web, patch
-
github.com
/xwiki/xwiki-platform/compare/8b68d8a70b43f25391b3ee48477d7eb71b95cf4b...99a04a0e2143583f5154a43e02174155da7e8
web, patch
-
github.com
/xwiki/xwiki-platform/security/advisories/GHSA-53gx-j3p6-2rw9
web, third-party-advisory
-
jira.xwiki.org
/browse/XWIKI-23438
web, issue-tracking
-
nvd.nist.gov
/vuln/detail/CVE-2025-55749
advisory
-
github.com
/xwiki/xwiki-platform
package
Sources
- CVE List CVE-2025-55749
- GitHub Advisory GHSA-53gx-j3p6-2rw9
- NVD CVE-2025-55749
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.