XWiki configuration files can be accessed through the webjars API

CRITICO 9.1CVE-2025-55747 · GHSA-qww7-89xh-x7m7 · Published 03/09/2025 · updated 17/06/2026

Package	Affected versions	Patched versions
org.xwiki.platform:xwiki-platform-webjars Maven	`≥ 6.1-miletone-2, ≤ 7.1.3`	No fix yet
org.xwiki.platform:xwiki-platform-webjars-api Maven	`≥ 17.0.0-rc-1, < 17.4.0-rc-1≥ 7.1.4, < 16.10.7`	`17.4.0-rc-116.10.7`
xwiki xwiki	`= 6.1≥ 17.0.0, ≤ 17.3.0≥ 6.2, < 16.10.7`	`16.10.7`

Description

Impact

It's possible to get access and read configuration files by using URLs such as http://localhost:8080/xwiki/webjars/wiki%3Axwiki/..%2F..%2F..%2F..%2F..%2FWEB-INF%2Fxwiki.cfg. The trick here is to encode the / which is decoded when parsing the URL segment, but not re-encoded when assembling the file path.

Patches

This has been patched in 17.4.0-rc-1, 16.10.7.

Workarounds

There is no known workaround, other than upgrading XWiki.

References

For more information

If you have any questions or comments about this advisory:

Open an issue in Jira XWiki.org
Email us at Security Mailing List

NVD description

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions 6.1-milestone-2 through 16.10.6, configuration files are accessible through the webjars API. This is fixed in version 16.10.7.

References

xwiki/xwiki-platform security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2025-55747 · ADVISORY
xwiki/xwiki-platform commit 9e7b4c0 · WEB
xwiki/xwiki-platform · PACKAGE
jira.xwiki.org/browse/XWIKI-19350 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free