GHSA-m63c-3rmg-r2cf

Source

https://github.com/advisories/GHSA-m63c-3rmg-r2cf

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/09/GHSA-m63c-3rmg-r2cf/GHSA-m63c-3rmg-r2cf.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-m63c-3rmg-r2cf

Aliases

CVE-2025-55748

Published

2025-09-03T17:45:11Z

Modified

2025-09-10T21:14:00Z

Severity

9.3 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

XWiki configuration files can be accessed through jsx and sx endpoints

Details

Impact

It's possible to get access and read configuration files by using URLs such as http://localhost:8080/bin/ssx/Main/WebHome?resource=../../WEB-INF/xwiki.cfg&minify=false.

This can apparently be reproduced on Tomcat instances.

Patches

This has been patched in 17.4.0-rc-1, 16.10.7.

Workarounds

There is no known workaround, other than upgrading XWiki.

For more information

If you have any questions or comments about this advisory:

Open an issue in Jira XWiki.org
Email us at Security Mailing List

Attribution

The vulnerability was reported by Gregor Neumann.

Database specific

{
    "cwe_ids": [
        "CWE-23"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-09-03T17:45:11Z",
    "nvd_published_at": "2025-09-03T21:15:32Z",
    "severity": "CRITICAL"
}

References

Affected packages

Maven / org.xwiki.platform:xwiki-platform-skin-skinx

Package

Name: org.xwiki.platform:xwiki-platform-skin-skinx; View open source insights on deps.dev
Purl: pkg:maven/org.xwiki.platform/xwiki-platform-skin-skinx

Affected ranges

Type: ECOSYSTEM
Events: Introduced

4.2-milestone-2

Fixed

16.10.7

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/09/GHSA-m63c-3rmg-r2cf/GHSA-m63c-3rmg-r2cf.json"