CVE-2025-55748

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions 4.2-milestone-2 through 16.10.6, configuration files are accessible through jsx and sx endpoints. It's possible to access and read configuration files by using URLs such as `http://localhost:8080/bin/ssx/Main/WebHome?resource=../../WEB-INF/xwiki.cfg&minify=false`. This is fixed in version 16.10.7.

• CWE-23

• https://github.com/xwiki/xwiki-platform/commit/9e7b4c03f2143978d891109a17159f73d4cdd318#diff-ee78930a9ac5ea586179fe8ab88a5fd58e369d175927d1e88a0b4dbc3ebcbf1eR62Patch
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-m63c-3rmg-r2cfVendor Advisory
• https://jira.xwiki.org/browse/XWIKI-23109Issue Tracking, Vendor Advisory

Published

Sep 3, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-55742UnoPim is an open-source Product Information Management (PIM…4.8
• CVE-2025-55743UnoPim is an open-source Product Information Management (PIM…8.8
• CVE-2025-55744UnoPim is an open-source Product Information Management (PIM…4.3
• CVE-2025-55745UnoPim is an open-source Product Information Management (PIM…8.8
• CVE-2025-55746Directus is a real-time API and App dashboard for managing S…7.5
• CVE-2025-55747XWiki Platform is a generic wiki platform offering runtime s…9.1
• CVE-2025-55749XWiki is an open-source wiki software platform. From 16.7.0 …7.5
• CVE-2025-5575A vulnerability classified as critical was found in PHPGuruk…9.8
• CVE-2025-55750Gitpod is a developer platform for cloud development environ…6.5
• CVE-2025-55751OnboardLite is the result of the Influx Initiative, our visi…5.1
• CVE-2025-55752Relative Path Traversal vulnerability in Apache Tomcat. The…7.5
• CVE-2025-55753An integer overflow in the case of failed ACME certificate r…7.5