What’s Vulnerable › Vulnerabilities

CVE-2025-55749: The XWiki Jetty package (XJetty) allows accessing any application file through URL

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-12-01 · updated 2026-09-26
• Weakness: CWE-284

Description

XWiki is an open-source wiki software platform. From 16.7.0 to 16.10.11, 17.4.4, or 17.7.0, in an instance which is using the XWiki Jetty package (XJetty), a context is exposed to statically access any file located in the webapp/ folder. It allows accessing files which might contains credentials. Fixed in 16.10.11, 17.4.4, and 17.7.0.

Affected products

• xwiki-platform: from 16.7.0 before 16.10.11; from 17.0.0 before 17.4.4; from 17.5.0 before 17.7.0 — fixed in 16.10.11, 17.4.4, 17.7.0

How to fix

Upgrade to a fixed version: xwiki-platform 16.10.11, 17.4.4, 17.7.0. Check the vendor advisory for mitigations.

References

• https://github.com/xwiki/xwiki-platform/commit/42fb063749dd88cc78196f72d7318b7179285ebd
• https://github.com/xwiki/xwiki-platform/commit/99a04a0e2143583f5154a43e02174155da7e8e10
• https://github.com/xwiki/xwiki-platform/compare/8b68d8a70b43f25391b3ee48477d7eb71b95cf4b...99a04a0e2143583f5154a43e02174155da7e8e10
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-53gx-j3p6-2rw9
• https://jira.xwiki.org/browse/XWIKI-23438

Get alerted when CVE-2025-55749 or the next vulnerability affects your stack