{"id":"CVE-2025-55748","summary":"XWiki Platform's configuration files can be accessed through jsx and sx endpoints","details":"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions 4.2-milestone-2 through 16.10.6, configuration files are accessible through jsx and sx endpoints. It's possible to access and read configuration files by using URLs such as `http://localhost:8080/bin/ssx/Main/WebHome?resource=../../WEB-INF/xwiki.cfg&minify=false`. This is fixed in version 16.10.7.","aliases":["GHSA-m63c-3rmg-r2cf"],"modified":"2026-08-12T15:16:45.504148Z","published":"2025-09-03T20:19:45.501Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/55xxx/CVE-2025-55748.json","cna_assigner":"GitHub_M","cwe_ids":["CWE-23"]},"references":[{"type":"WEB","url":"https://jira.xwiki.org/browse/XWIKI-23109"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/55xxx/CVE-2025-55748.json"},{"type":"ADVISORY","url":"https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-m63c-3rmg-r2cf"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-55748"},{"type":"FIX","url":"https://github.com/xwiki/xwiki-platform/commit/9e7b4c03f2143978d891109a17159f73d4cdd318#diff-ee78930a9ac5ea586179fe8ab88a5fd58e369d175927d1e88a0b4dbc3ebcbf1eR62"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/xwiki/xwiki-commons","events":[{"introduced":"390be97f58fa86ff3f87d7aacd32bb70ac64459b"},{"fixed":"57d47c61d5524d9c61eb26e7b709fd15629695d8"},{"introduced":"e84d9bd1b4c0c8219597e10acfd8fbd692416294"},{"last_affected":"77262561546ae119163fbd5ffc09149e27a8e41d"},{"introduced":"65026305bca6d736adf61a6801a9187195ef431d"},{"last_affected":"d6d09da02106336d4756d6366ceac741d7367916"}],"database_specific":{"cpe":["cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*","cpe:2.3:a:xwiki:xwiki:4.2:milestone2:*:*:*:*:*:*","cpe:2.3:a:xwiki:xwiki:4.2:milestone3:*:*:*:*:*:*"],"extracted_events":[{"introduced":"4.3"},{"fixed":"16.10.7"},{"introduced":"17.0.0"},{"last_affected":"17.3.0"},{"introduced":"4.2-milestone2"},{"last_affected":"4.2-milestone2"},{"introduced":"4.2-milestone3"},{"last_affected":"4.2-milestone3"}],"source":["CPE_RANGE","CPE_STRING"]}},{"type":"GIT","repo":"https://github.com/xwiki/xwiki-platform","events":[{"introduced":"a02e0795680d5bb4067cb69050f8d084cf44dc90"},{"fixed":"a839534ee4037fe44e8e34603d4808a9c617051c"},{"introduced":"7edb5b7d98170ec081c7e30237971d7dfb8a4401"},{"last_affected":"6eddd24a6f92d7d59df99d5a0fb6d5478c0c3ca9"},{"introduced":"86f857179e8b4b41e6363e2dc9cc6ea96cc223a2"},{"fixed":"9e7b4c03f2143978d891109a17159f73d4cdd318"}],"database_specific":{"extracted_events":[{"introduced":"4.3"},{"fixed":"16.10.7"},{"introduced":"17.0.0"},{"last_affected":"17.3.0"},{"introduced":"4.2-milestone2"},{"last_affected":"4.2-milestone2"},{"introduced":"4.2-milestone3"},{"last_affected":"4.2-milestone3"}],"source":["CPE_RANGE","CPE_STRING","REFERENCES"],"cpe":["cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*","cpe:2.3:a:xwiki:xwiki:4.2:milestone2:*:*:*:*:*:*","cpe:2.3:a:xwiki:xwiki:4.2:milestone3:*:*:*:*:*:*"]}}],"versions":["4.2-milestone2","4.2-milestone3"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-55748.json","vanir_signatures_modified":"2026-08-12T15:16:45Z","vanir_signatures":[{"signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/9e7b4c03f2143978d891109a17159f73d4cdd318","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/internal/template/InternalTemplateManager.java"},"deprecated":false,"digest":{"line_hashes":["285805244130630666941075460701450668401","249810396643444817015712403550413249902","153343030864296103107704987949784927826","39337590695113612093454116561656469756","217806531897885643865162867221406079409","273117605049762811876491167741288955005","14408323119301519001348394018766371146","137935493172197716660716195689925191211","67552508951967422980994867358547162820","225710281679778306491182464431726961161","308857375801359120954523088512357847114","130638571371041312369533488748968875910","66987467405931167580603225557378000627","107986411180198824586395714216257182897"],"threshold":0.9},"id":"CVE-2025-55748-2762350d"},{"target":{"file":"xwiki-platform-core/xwiki-platform-resource/xwiki-platform-resource-servlet/src/main/java/org/xwiki/resource/servlet/AbstractServletResourceReferenceHandler.java","function":"handle"},"deprecated":false,"digest":{"function_hash":"310331862322912464852775761838112496761","length":833},"id":"CVE-2025-55748-428ceacd","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/9e7b4c03f2143978d891109a17159f73d4cdd318"},{"target":{"file":"xwiki-platform-core/xwiki-platform-webjars/xwiki-platform-webjars-api/src/main/java/org/xwiki/webjars/internal/WebJarsResourceReferenceHandler.java"},"deprecated":false,"digest":{"line_hashes":["40203274243239412557334553176433317850","247417337402020905759242307534907040337","73857261607684000562482532443334695888","71255199098641070792539758648758643763","299700138737434534483850425369343109182","27974845298216075816217198332835035073","216587458360273756355661787703353634397","208018057891476198147659491931987728295","85638464364511947217910262237117284452"],"threshold":0.9},"id":"CVE-2025-55748-60e69f65","signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/9e7b4c03f2143978d891109a17159f73d4cdd318"},{"deprecated":false,"digest":{"line_hashes":["125387527819263099012390324055921660422","144097468309161170002630212025073590203","30403201867991609273572295962392427369","117620941793744792079675592339250689817","139163496552322933398096633556814003547","130094609744730625909199222198707288094","50588064872935288945032186616286308258"],"threshold":0.9},"id":"CVE-2025-55748-9e93df38","signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/9e7b4c03f2143978d891109a17159f73d4cdd318","target":{"file":"xwiki-platform-core/xwiki-platform-webjars/xwiki-platform-webjars-test/xwiki-platform-webjars-test-tests/src/test/it/org/xwiki/webjars/test/ui/WebJarsTest.java"}},{"id":"CVE-2025-55748-aa95b57e","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/9e7b4c03f2143978d891109a17159f73d4cdd318","target":{"file":"xwiki-platform-core/xwiki-platform-skin/xwiki-platform-skin-skinx/src/main/java/com/xpn/xwiki/web/sx/SxResourceSource.java","function":"getContent"},"deprecated":false,"digest":{"function_hash":"243466972736808307263144909591992210456","length":315}},{"signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/9e7b4c03f2143978d891109a17159f73d4cdd318","target":{"file":"xwiki-platform-core/xwiki-platform-webjars/xwiki-platform-webjars-api/src/main/java/org/xwiki/webjars/internal/WebJarsResourceReferenceHandler.java","function":"getResourceStream"},"deprecated":false,"digest":{"function_hash":"246289447244328299531987661455650877754","length":185},"id":"CVE-2025-55748-c106fa1e","signature_type":"Function"},{"deprecated":false,"digest":{"function_hash":"62123839857146875315236893365593116386","length":418},"id":"CVE-2025-55748-c324536f","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/9e7b4c03f2143978d891109a17159f73d4cdd318","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/internal/template/InternalTemplateManager.java","function":"getClassloaderTemplate"}},{"target":{"file":"xwiki-platform-core/xwiki-platform-resource/xwiki-platform-resource-servlet/src/main/java/org/xwiki/resource/servlet/AbstractServletResourceReferenceHandler.java"},"deprecated":false,"digest":{"line_hashes":["119715508682807809640366745873013200480","231237806956979737891617834412841923940","305601165199337995165758998548501859978","210589381300590710307227422787496337622"],"threshold":0.9},"id":"CVE-2025-55748-cd452596","signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/9e7b4c03f2143978d891109a17159f73d4cdd318"},{"source":"https://github.com/xwiki/xwiki-platform/commit/9e7b4c03f2143978d891109a17159f73d4cdd318","target":{"file":"xwiki-platform-core/xwiki-platform-skin/xwiki-platform-skin-skinx/src/main/java/com/xpn/xwiki/web/sx/SxResourceSource.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["138458674238258391158442592950440297640","10756059771825690888615285433709016550","50028444234906373642886206422953620835","209089830092768796579661981655066073464","326923217221830606091258549968863758098","123072876614177874581997898136118302480","80569524397154847114649905466645602013","91523874312371929129078693815153318925"]},"id":"CVE-2025-55748-e4fb43fc","signature_type":"Line","signature_version":"v1"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}]}