GitHub Advisoryadvisory · Maven

GHSA-qww7-89xh-x7m7 XWiki configuration files can be accessed through the webjars API

CRITICAL Published 2025-09-03 Modified 2026-05-04 Official page ↗
Aliases
CVE-2025-55747
Ecosystem
Maven
Packages
org.xwiki.platform:xwiki-platform-webjars-api, org.xwiki.platform:xwiki-platform-webjars
Severity
Critical
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Weaknesses
CWE-23
Reviewed
2025-09-03

Affected packages

• Maven org.xwiki.platform:xwiki-platform-webjars-api: >= 7.1.4, < 16.10.7 → fixed in 16.10.7 • Maven org.xwiki.platform:xwiki-platform-webjars-api: >= 17.0.0-rc-1, < 17.4.0-rc-1 → fixed in 17.4.0-rc-1 • Maven org.xwiki.platform:xwiki-platform-webjars: >= 6.1-miletone-2, <= 7.1.3 (no fix yet)

Description

Impact It's possible to get access and read configuration files by using URLs such as http://localhost:8080/xwiki/webjars/wiki%3Axwiki/..%2F..%2F..%2F..%2F..%2FWEB-INF%2Fxwiki.cfg. The trick here is to encode the / which is decoded when parsing the URL segment, but not re-encoded when assembling the file path. Patches This has been patched in 17.4.0-rc-1, 16.10.7. Workarounds There is no known workaround, other than upgrading XWiki. References • https://jira.xwiki.org/browse/XWIKI-19350 • https://github.com/xwiki/xwiki-platform/commit/9e7b4c03f2143978d891109a17159f73d4cdd318#diff-45ea9c87d5fb68cd5db0da7f78cf25e76f1325f5fe56e21618b21786fc706236R80-R81 For more information If you have any questions or comments about this advisory: • Open an issue in Jira XWiki.org • Email us at Security Mailing List

Related

Alias · CVE (1)

  • CVE-2025-55747 XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. vulnerability

Weakness · CWE (1)

  • CWE-23 Relative Path Traversal weakness

References