CVE-2025-55748 — Vulnerability in...

CRITICAL

XWiki configuration files can be accessed through jsx and sx endpoints

Published September 3, 2025Updated September 10, 2025Source: osv

Summary

### Impact It's possible to get access and read configuration files by using URLs such as `http://localhost:8080/bin/ssx/Main/WebHome?resource=../../WEB-INF/xwiki.cfg&minify=false`. This can apparently be reproduced on Tomcat instances. ### Patches This has been patched in 17.4.0-rc-1, 16.10.7. ### Workarounds There is no known workaround, other than upgrading XWiki. ### For more information If you have any questions or comments about this advisory: * Open an issue in [Jira XWiki.org](https://jira.xwiki.org/) * Email us at [Security Mailing List](mailto:security@xwiki.org) ### Attribution The vulnerability was reported by Gregor Neumann.

Advisory Timeline

First published September 3, 2025 (404 days ago).
Last revised September 10, 2025 — 7 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

Maven

Update org.xwiki.platform:xwiki-platform-skin-skinx to 16.10.7 or later

<!-- Update pom.xml dependency version to 16.10.7 for org.xwiki.platform:xwiki-platform-skin-skinx -->

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (1)

Affects 1 ecosystem: maven (1).

Package	Ecosystem	Affected	Fixed In
org.xwiki.platform:xwiki-platform-skin-skinx	maven	All versions	16.10.7

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CWE-23
View on MITRE

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 9.8 score means for each attack dimension.

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

—

Confidentiality

—

Integrity

—

Availability

—

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

Frequently Asked Questions

What is CVE-2025-55748?: XWiki configuration files can be accessed through jsx and sx endpoints This vulnerability has been assigned a severity rating of CRITICAL (CVSS score: 9.8/10).
How do I check if my project is affected by CVE-2025-55748?: CVE-2025-55748 affects org.xwiki.platform:xwiki-platform-skin-skinx. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2025-55748 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score

9.8

Exploitation is straightforward and causes maximum impact. Patch immediately.

Also Known As

GHSA-m63c-3rmg-r2cf

Related CVEs

CVE-2023-32070
CRITICAL
Improper Neutralization of Script in Attributes in XWiki (X)HTML renderers
CVE-2023-29514
CRITICAL
XWiki vulnerable to Code Injection in template provider administration
CVE-2023-36470
CRITICAL
XWiki Platform vulnerable to Code Injection in icon themes
CVE-2023-45135
CRITICAL
XWiki users can be tricked to execute scripts as the create page action doesn't display the page's title
CVE-2023-29526
CRITICAL
XWiki Platform's async and display macro allow displaying and interacting with any document in restricted mode
CVE-2023-45134
CRITICAL
XWiki Platform XSS vulnerability from account in the create page form via template provider
CVE-2023-29207
HIGH
Improper Neutralization of Script-Related HTML Tags (XSS) in the LiveTable Macro
CVE-2025-49582
HIGH
XWiki's required right warnings for macros are incomplete

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies