Vulnerability details

CVE-2025-55747

xwiki xwiki-platform

XWiki Platform's configuration files can be accessed through the webjars API

CVSS 4.0

9.3Critical

Official description

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions 6.1-milestone-2 through 16.10.6, configuration files are accessible through the webjars API. This is fixed in version 16.10.7.

CVSS scores

Score	Version	Source	Vector
9.3Critical	4.0	CVEProject cvelistV5 (CNA) (GitHub_M)	`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N`

Affected products

Vendor	Product	Versions	Source
xwiki	xwiki-platform	>= 6.1-milestone-2, < 16.10.7	CVEProject cvelistV5 (CNA)

References and advisories

https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-qww7-89xh-x7m7 x_refsource_CONFIRM
https://github.com/xwiki/xwiki-platform/commit/9e7b4c03f2143978d891109a17159f73d4cdd318#diff-45ea9c87d5fb68cd5db0da7f78cf25e76f1325f5fe56e21618b21786fc706236R80-R81 x_refsource_MISC
https://jira.xwiki.org/browse/XWIKI-19350 x_refsource_MISC

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2025-09-03
Last updated: 2025-09-04
State: Published
Assigner (CNA): GitHub_M

Exploit prediction (EPSS)

1.75%

Probability of exploitation in 30 days

77.9%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: No
Exploitation: None
Technical impact: Partial

Weaknesses (CWE)

CWE-23
Relative Path Traversal