CVE-2025-55747

XWiki Platform's configuration files can be accessed through the webjars API

9.3 CriticalFix available

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions 6.1-milestone-2 through 16.10.6, configuration files are accessible through the webjars API. This is fixed in version 16.10.7.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

1.75%Up 1.7 points since Sep 4, 2025

What each source reports

CVE List Score used 9.3

XWiki Platform's configuration files can be accessed through the webjars API

Record: CVE-2025-55747
CVSS 4.0: 9.3 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Weakness: CWE-23
Updated: 2026-11-02

EUVDEUVD-2025-26642 9.3

Record: EUVD-2025-26642
CVSS 4.0: 9.3 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-qww7-89xh-x7m7 9.3

XWiki configuration files can be accessed through the webjars API

Impact

It's possible to get access and read configuration files by using URLs such as http://localhost:8080/xwiki/webjars/wiki%3Axwiki/..%2F..%2F..%2F..%2F..%2FWEB-INF%2Fxwiki.cfg. The trick here is to encode the / which is decoded when parsing the URL segment, but not re-encoded when assembling the file path.

Patches

This has been patched in 17.4.0-rc-1, 16.10.7.

Workarounds

There is no known workaround, other than upgrading XWiki.

References

For more information

If you have any questions or comments about this advisory:

Open an issue in Jira XWiki.org
Email us at Security Mailing List

Record: GHSA-qww7-89xh-x7m7
CVSS 4.0: 9.3 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Weakness: CWE-23
Updated: 2026-11-02

NVD 9.3

Record: CVE-2025-55747
CVSS 4.0: 9.3 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness: CWE-23
Updated: 2026-11-02

OSV 9.3

XWiki Platform's configuration files can be accessed through the webjars API

Record: CVE-2025-55747
CVSS 4.0: 9.3 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Weakness: CWE-23
Updated: 2026-11-02

OSVGHSA-qww7-89xh-x7m7 9.3

XWiki configuration files can be accessed through the webjars API

Impact

Patches

This has been patched in 17.4.0-rc-1, 16.10.7.

Workarounds

There is no known workaround, other than upgrading XWiki.

References

For more information

If you have any questions or comments about this advisory:

Open an issue in Jira XWiki.org
Email us at Security Mailing List

Record: GHSA-qww7-89xh-x7m7
CVSS 4.0: 9.3 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Weakness: CWE-23
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`org.xwiki.platform:xwiki-platform-webjars-api` Maven	7.1.4 up to 16.10.7	16.10.7
`org.xwiki.platform:xwiki-platform-webjars-api` Maven	17.0.0-rc-1 up to 17.4.0-rc-1	17.4.0-rc-1
`org.xwiki.platform:xwiki-platform-webjars` Maven	6.1-miletone-2 to 7.1.3	None known

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Nuclei	XWiki Platform - Information Disclosure

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, Nuclei, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-55747 is a critical vulnerability (CVSS 9.3) in Xwiki, published September 3, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.75%, the 77th percentile. Fixed in org.xwiki.platform:xwiki-platform-webjars-api 16.10.7.