CVE-2025-55747: 
Java vulnerability analysis and mitigation

CVE-2025-55747 is a relative path traversal vulnerability in XWiki Platform's webjars API that allows unauthenticated remote attackers to read arbitrary configuration files from the server. The flaw affects org.xwiki.platform:xwiki-platform-webjars versions from 6.1-milestone-2 through 7.1.3, and org.xwiki.platform:xwiki-platform-webjars-api versions 7.1.4 through 16.10.6 and 17.0.0-rc-1 through 17.3.0. It was published on September 3, 2025, by the XWiki security team. The vulnerability carries a CVSS v4 base score of 9.3 (Critical) and a CVSS v3.1 base score of 9.1 (Critical) (Github Advisory, XWiki Advisory).

The root cause is a URL decoding inconsistency classified as CWE-23 (Relative Path Traversal). When the webjars API processes a URL, percent-encoded forward slashes (%2F) are decoded during URL segment parsing but are not re-encoded when the resulting string is assembled into a file system path. This allows an attacker to craft a URL such as http://target/xwiki/webjars/wiki%3Axwiki/..%2F..%2F..%2F..%2F..%2FWEB-INF%2Fxwiki.cfg that traverses outside the intended webjars resource directory and reads protected files like WEB-INF/xwiki.cfg. The fix, committed in 9e7b4c0, introduces ClassLoaderUtils.getResourceAsStream() with proper path validation to prevent traversal sequences from resolving outside the permitted prefix (XWiki Advisory, Patch Commit). Nuclei templates for automated detection of this vulnerability have been added to the ProjectDiscovery repository (Github Advisory).

Successful exploitation allows an unauthenticated attacker to read arbitrary files accessible to the XWiki application process, including sensitive configuration files such as WEB-INF/xwiki.cfg. These files may contain database credentials, secret keys, and other confidential system configuration data, enabling further attacks such as credential reuse, privilege escalation, or full system compromise. The vulnerability has high confidentiality and integrity impact on the vulnerable system, with no authentication or user interaction required (XWiki Advisory, Github Advisory).

No public proof-of-concept exploit code has been confirmed, and there is no evidence of in-the-wild exploitation at the time of disclosure (Github Advisory). However, the attack requires no authentication, no user interaction, and no special preconditions, making it trivially exploitable by any network-accessible attacker. The EPSS score is approximately 1.292% (80th percentile), indicating a moderate near-term exploitation probability (Github Advisory). Nuclei detection templates have been added to the ProjectDiscovery repository, facilitating automated scanning. The vulnerability is not currently listed in the CISA KEV catalog. Qualys has published a detection (ID 530593) for this vulnerability.

1. Reconnaissance: Identify internet-facing XWiki instances using tools like Shodan or Censys, searching for the XWiki web interface (default port 8080). Confirm the version is in the affected range (6.1-milestone-2 through 16.10.6 or 17.0.0-rc-1 through 17.3.0).
2. Craft the traversal URL: Construct a URL targeting the webjars endpoint with percent-encoded path traversal sequences. For example: http://<target>:8080/xwiki/webjars/wiki%3Axwiki/..%2F..%2F..%2F..%2F..%2FWEB-INF%2Fxwiki.cfg
3. Send the HTTP GET request: Issue the crafted request directly using curl, a browser, or an automated scanner (e.g., a Nuclei template). No authentication headers are required.
4. Retrieve sensitive file contents: If the target is vulnerable, the server returns the contents of xwiki.cfg or other targeted files (e.g., WEB-INF/web.xml, WEB-INF/hibernate.cfg.xml) containing database credentials, secret keys, or other sensitive configuration data.
5. Leverage obtained credentials: Use extracted credentials to access the database, escalate privileges within XWiki, or pivot to other systems in the environment (XWiki Advisory, Patch Commit).

• Network: HTTP GET requests to the XWiki webjars endpoint containing percent-encoded path traversal sequences such as %2F..%2F, %2FWEB-INF%2F, or similar patterns; requests to /xwiki/webjars/ with encoded .. sequences in the path.
• Logs: Web server or application access logs showing requests matching the pattern /xwiki/webjars/wiki%3Axwiki/..%2F..%2F..%2F..%2F..%2FWEB-INF%2F with HTTP 200 response codes on unpatched systems; repeated requests to the webjars endpoint from a single IP targeting different configuration files.
• File System: No direct file system artifacts are created by read-only exploitation; however, if credentials obtained are used for follow-on access, look for unexpected authentication events or new user accounts in XWiki logs.
• Application Logs: XWiki application logs (xwiki.log) may show warnings about path traversal attempts if partially patched, or absence of such warnings on fully unpatched systems where traversal succeeds silently (XWiki Advisory).

The vulnerability is patched in XWiki versions 16.10.7 and 17.4.0-rc-1. There is no known configuration-based workaround; upgrading to a patched version is the only remediation (XWiki Advisory, Github Advisory). As interim measures, administrators should restrict network access to the XWiki application to trusted sources, monitor web server logs for traversal patterns in webjars requests, and ensure sensitive configuration files do not contain credentials that could enable further compromise if exposed.

The vulnerability was published by XWiki maintainer tmortagne on September 3, 2025, and quickly indexed by major vulnerability databases including NVD, ENISA EUVD, and Qualys. Social media activity on Mastodon (infosec.exchange) and Bluesky noted the disclosure shortly after publication. Qualys added a web application detection (ID 530593) for the vulnerability, and ProjectDiscovery added multiple Nuclei detection templates to their public repository, indicating active community interest in automated scanning for this flaw (Github Advisory).