XWiki configuration files can be accessed through jsx and sx endpoints

HOCH 7.5CVE-2025-55748 · GHSA-m63c-3rmg-r2cf · Published 03/09/2025 · updated 30/09/2026

Package	Affected versions	Patched versions
org.xwiki.platform:xwiki-platform-skin-skinx Maven	`≥ 4.2-milestone-2, < 16.10.7`	`16.10.7`
xwiki xwiki	`= 4.2≥ 17.0.0, ≤ 17.3.0≥ 4.3, < 16.10.7`	`16.10.7`

Description

Impact

It's possible to get access and read configuration files by using URLs such as http://localhost:8080/bin/ssx/Main/WebHome?resource=../../WEB-INF/xwiki.cfg&minify=false.

This can apparently be reproduced on Tomcat instances.

Patches

This has been patched in 17.4.0-rc-1, 16.10.7.

Workarounds

There is no known workaround, other than upgrading XWiki.

For more information

If you have any questions or comments about this advisory:

Open an issue in Jira XWiki.org
Email us at Security Mailing List

Attribution

The vulnerability was reported by Gregor Neumann.

NVD description

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions 4.2-milestone-2 through 16.10.6, configuration files are accessible through jsx and sx endpoints. It's possible to access and read configuration files by using URLs such as `http://localhost:8080/bin/ssx/Main/WebHome?resource=../../WEB-INF/xwiki.cfg&minify=false`. This is fixed in version 16.10.7.

References

xwiki/xwiki-platform security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2025-55748 · ADVISORY
xwiki/xwiki-platform commit 9e7b4c0 · WEB
xwiki/xwiki-platform · PACKAGE
jira.xwiki.org/browse/XWIKI-23109 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

org.xwiki.platform:xwiki-platform-skin-skinx

Maven

≥ 4.2-milestone-2, < 16.10.7

16.10.7

xwiki

= 4.2≥ 17.0.0, ≤ 17.3.0≥ 4.3, < 16.10.7

16.10.7

Description

Impact

It's possible to get access and read configuration files by using URLs such as http://localhost:8080/bin/ssx/Main/WebHome?resource=../../WEB-INF/xwiki.cfg&minify=false.

This can apparently be reproduced on Tomcat instances.

Patches

This has been patched in 17.4.0-rc-1, 16.10.7.

Workarounds

There is no known workaround, other than upgrading XWiki.

For more information

If you have any questions or comments about this advisory:

Open an issue in Jira XWiki.org
Email us at Security Mailing List

Attribution

The vulnerability was reported by Gregor Neumann.

NVD description