GHSA-qww7-89xh-x7m7

Source

https://github.com/advisories/GHSA-qww7-89xh-x7m7

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/09/GHSA-qww7-89xh-x7m7/GHSA-qww7-89xh-x7m7.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-qww7-89xh-x7m7

Aliases

CVE-2025-55747

Published

2025-09-03T17:42:51Z

Modified

2026-05-05T15:55:48Z

Severity

9.3 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

XWiki configuration files can be accessed through the webjars API

Details

Impact

It's possible to get access and read configuration files by using URLs such as http://localhost:8080/xwiki/webjars/wiki%3Axwiki/..%2F..%2F..%2F..%2F..%2FWEB-INF%2Fxwiki.cfg. The trick here is to encode the / which is decoded when parsing the URL segment, but not re-encoded when assembling the file path.

Patches

This has been patched in 17.4.0-rc-1, 16.10.7.

Workarounds

There is no known workaround, other than upgrading XWiki.

References

For more information

If you have any questions or comments about this advisory:

Open an issue in Jira XWiki.org
Email us at Security Mailing List

Database specific

{
    "cwe_ids":  [
        "CWE-23"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2025-09-03T17:42:51Z",
    "nvd_published_at":  "2025-09-03T21:15:31Z",
    "severity":  "CRITICAL"
}

References

Affected packages

Maven

org.xwiki.platform:xwiki-platform-webjars-api

Package

Name: org.xwiki.platform:xwiki-platform-webjars-api; View open source insights on deps.dev
Purl: pkg:maven/org.xwiki.platform/xwiki-platform-webjars-api

Affected ranges

Type: ECOSYSTEM
Events: Introduced

7.1.4

Fixed

16.10.7

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/09/GHSA-qww7-89xh-x7m7/GHSA-qww7-89xh-x7m7.json"

org.xwiki.platform:xwiki-platform-webjars-api

Package

Name: org.xwiki.platform:xwiki-platform-webjars-api; View open source insights on deps.dev
Purl: pkg:maven/org.xwiki.platform/xwiki-platform-webjars-api

Affected ranges

Type: ECOSYSTEM
Events: Introduced

17.0.0-rc-1

Fixed

17.4.0-rc-1

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/09/GHSA-qww7-89xh-x7m7/GHSA-qww7-89xh-x7m7.json"

org.xwiki.platform:xwiki-platform-webjars

Package

Name: org.xwiki.platform:xwiki-platform-webjars; View open source insights on deps.dev
Purl: pkg:maven/org.xwiki.platform/xwiki-platform-webjars

Affected ranges

Type: ECOSYSTEM
Events: Introduced

6.1-miletone-2

Last Affected

7.1.3

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/09/GHSA-qww7-89xh-x7m7/GHSA-qww7-89xh-x7m7.json"