{"id":"GHSA-qww7-89xh-x7m7","summary":"XWiki configuration files can be accessed through the webjars API","details":"### Impact\n\nIt's possible to get access and read configuration files by using URLs such as http://localhost:8080/xwiki/webjars/wiki%3Axwiki/..%2F..%2F..%2F..%2F..%2FWEB-INF%2Fxwiki.cfg. The trick here is to encode the / which is decoded when parsing the URL segment, but not re-encoded when assembling the file path.\n\n### Patches\n\nThis has been patched in 17.4.0-rc-1, 16.10.7.\n\n### Workarounds\n\nThere is no known workaround, other than upgrading XWiki.\n\n### References\n\n* https://jira.xwiki.org/browse/XWIKI-19350\n* https://github.com/xwiki/xwiki-platform/commit/9e7b4c03f2143978d891109a17159f73d4cdd318#diff-45ea9c87d5fb68cd5db0da7f78cf25e76f1325f5fe56e21618b21786fc706236R80-R81\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n* Open an issue in [Jira XWiki.org](https://jira.xwiki.org/)\n* Email us at [Security Mailing List](mailto:security@xwiki.org)","aliases":["CVE-2025-55747"],"modified":"2026-05-05T15:55:48.710457Z","published":"2025-09-03T17:42:51Z","database_specific":{"nvd_published_at":"2025-09-03T21:15:31Z","cwe_ids":["CWE-23"],"severity":"CRITICAL","github_reviewed":true,"github_reviewed_at":"2025-09-03T17:42:51Z"},"references":[{"type":"WEB","url":"https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-qww7-89xh-x7m7"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-55747"},{"type":"WEB","url":"https://github.com/xwiki/xwiki-platform/commit/9e7b4c03f2143978d891109a17159f73d4cdd318#diff-45ea9c87d5fb68cd5db0da7f78cf25e76f1325f5fe56e21618b21786fc706236R80-R81"},{"type":"PACKAGE","url":"https://github.com/xwiki/xwiki-platform"},{"type":"WEB","url":"https://jira.xwiki.org/browse/XWIKI-19350"}],"affected":[{"package":{"name":"org.xwiki.platform:xwiki-platform-webjars-api","ecosystem":"Maven","purl":"pkg:maven/org.xwiki.platform/xwiki-platform-webjars-api"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.1.4"},{"fixed":"16.10.7"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/09/GHSA-qww7-89xh-x7m7/GHSA-qww7-89xh-x7m7.json"}},{"package":{"name":"org.xwiki.platform:xwiki-platform-webjars-api","ecosystem":"Maven","purl":"pkg:maven/org.xwiki.platform/xwiki-platform-webjars-api"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17.0.0-rc-1"},{"fixed":"17.4.0-rc-1"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/09/GHSA-qww7-89xh-x7m7/GHSA-qww7-89xh-x7m7.json"}},{"package":{"name":"org.xwiki.platform:xwiki-platform-webjars","ecosystem":"Maven","purl":"pkg:maven/org.xwiki.platform/xwiki-platform-webjars"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.1-miletone-2"},{"last_affected":"7.1.3"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/09/GHSA-qww7-89xh-x7m7/GHSA-qww7-89xh-x7m7.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}]}