Directory Traversal Vulnerability in XWiki Platform by XWiki SAS
CVE-2025-55748

9.3CRITICAL

Key Information:

Vendor

Xwiki
Status
Xwiki-platform
Vendor
CVE Published:
3 September 2025

What is CVE-2025-55748?

A directory traversal vulnerability exists in the XWiki Platform allowing attackers to access sensitive configuration files through improperly secured endpoints. This issue impacts versions 4.2-milestone-2 through 16.10.6, where accessed URLs can expose the 'xwiki.cfg' file by exploiting jsx and sx endpoints. The vulnerability has been resolved in version 16.10.7, ensuring that these critical file access points are protected against unauthorized user access.

Affected Version(s)

xwiki-platform >= 4.2-milestone-2, < 16.10.7

References

https://github.com/xwiki/xwiki-platform/security/advisori...
x_refsource_CONFIRM
https://github.com/xwiki/xwiki-platform/commit/9e7b4c03f2...
x_refsource_MISC
https://jira.xwiki.org/browse/XWIKI-23109
x_refsource_MISC

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2025-55748 : Directory Traversal Vulnerability in XWiki Platform by XWiki SAS