CVE-2025-55748

🗓️ 03 Sep 2025 20:19:45Reported by GitHub_MType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 53 Views🌐 WEB

CVE-2025-55748 enables reading XWiki configuration via jsx and sx endpoints; fixed in 16.10.7.

Reporter	Title	Published	Views	Family All 16
BDU FSTEC	The vulnerability of the org.xwiki.platform:xwiki-platform-skin-skinx component of the XWiki Platform, a platform for creating collaborative web applications. This vulnerability allows an attacker to compromise the confidentiality of protected information.	28 Oct 202500:00	–	bdu_fstec
Circl	CVE-2025-55748	3 Sep 202523:00	–	circl
CNNVD	XWiki Platform 安全漏洞	3 Sep 202500:00	–	cnnvd
Cvelist	CVE-2025-55748 XWiki Platform's configuration files can be accessed through jsx and sx endpoints	3 Sep 202520:19	–	cvelist
EUVD	EUVD-2025-26643	3 Oct 202520:07	–	euvd
Github Security Blog	XWiki configuration files can be accessed through jsx and sx endpoints	3 Sep 202517:45	–	github
Nuclei	XWiki Platform - Path Traversal	21 Jul 202603:59	–	nuclei
NVD	CVE-2025-55748	3 Sep 202521:15	–	nvd
OSV	CVE-2025-55748 XWiki Platform's configuration files can be accessed through jsx and sx endpoints	3 Sep 202520:19	–	osv
OSV	GHSA-M63C-3RMG-R2CF XWiki configuration files can be accessed through jsx and sx endpoints	3 Sep 202517:45	–	osv

NVD

Vulners

Node

xwiki xwikiRange4.3–16.10.7

xwiki xwikiRange17.0.0–17.3.0

xwiki xwikiMatch4.2milestone2

xwiki xwikiMatch4.2milestone3

[
  {
    "vendor": "xwiki",
    "product": "xwiki-platform",
    "versions": [
      {
        "version": ">= 4.2-milestone-2, < 16.10.7",
        "status": "affected"
      }
    ]
  }
]

Source	Link
jira	www.jira.xwiki.org/browse/XWIKI-23109
github	www.github.com/xwiki/xwiki-platform/commit/9e7b4c03f2143978d891109a17159f73d4cdd318
github	www.github.com/xwiki/xwiki-platform/security/advisories/GHSA-m63c-3rmg-r2cf

Parameter	Position	Path	Description	CWE
resource	query param	bin/ssx/Main/WebHome?resource=../../WEB-INF/xwiki.cfg&minify=false	Accessible configuration files via jsx/sx endpoints allowing read of WEB-INF/xwiki.cfg	CWE-23
minify	query param	bin/ssx/Main/WebHome?resource=../../WEB-INF/xwiki.cfg&minify=false	Accessible configuration files via jsx/sx endpoints allowing read of WEB-INF/xwiki.cfg	CWE-23

17 Jun 2026 09:42Current

6.2Medium risk

Vulners AI Score6.2

CVSS 3.17.5

CVSS 49.3

EPSS0.01652

SSVC