CVE-2025-55749: 
Java vulnerability analysis and mitigation

CVE-2025-55749 is an improper access control vulnerability in the XWiki Jetty package (XJetty) that allows unauthenticated remote attackers to read any file within the webapp/ directory, including sensitive configuration files containing credentials. It affects XWiki Platform versions 16.7.0 through 16.10.10, 17.0.0 through 17.4.3, and 17.5.0 through 17.6.x. The vulnerability was disclosed on December 1, 2025, and was reported by Joseph Huber. It carries a CVSS v3.1 score of 7.5 (High) and a CVSS v4.0 score of 8.7 (High) (GitHub Advisory).

The root cause is a misconfiguration in the start_xwiki.sh startup script for the XJetty package, classified as CWE-284 (Improper Access Control). When JETTY_BASE was set to a relative path (.), Jetty exposed a static file-serving context that allowed direct URL-based access to any file under the webapp/ directory, bypassing intended access restrictions. This means an unauthenticated attacker can craft a simple HTTP GET request to retrieve sensitive files such as WEB-INF/xwiki.cfg, WEB-INF/xwiki.properties, or WEB-INF/hibernate.cfg.xml — files that typically contain database credentials and other secrets. No authentication, user interaction, or special preconditions are required beyond network access to the XWiki instance (GitHub Advisory, Patch Commit).

Successful exploitation results in a high confidentiality impact, exposing sensitive configuration files that may contain database credentials (via hibernate.cfg.xml), application secrets, and internal system configuration details (via xwiki.cfg and xwiki.properties). An attacker who obtains database credentials could pivot to the backend database, potentially enabling data exfiltration, privilege escalation within the XWiki application, or lateral movement to other systems. There is no direct integrity or availability impact from this vulnerability itself, but credential exposure significantly elevates the risk of further compromise (GitHub Advisory).

No public proof-of-concept exploit code has been observed, and there is no evidence of in-the-wild exploitation at this time (GitHub Advisory). The vulnerability is trivially exploitable — it requires only a crafted HTTP GET request with no authentication — making it highly accessible to low-skilled attackers once the affected version is identified. The EPSS score is approximately 0.04%, indicating currently low predicted exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Notably, Nuclei templates for automated detection of this vulnerability have been added to the ProjectDiscovery nuclei-templates repository, increasing the likelihood of opportunistic scanning.

1. Reconnaissance: Identify internet-facing XWiki instances using the XJetty (XWiki Jetty) package via Shodan, Censys, or similar tools. Confirm the version falls within the affected range (16.7.0–16.10.10, 17.0.0–17.4.3, or 17.5.0–17.6.x).
2. Probe for file access: Send an unauthenticated HTTP GET request directly to the target host for a known sensitive file path, e.g.:

   GET /webapps/xwiki/WEB-INF/xwiki.cfg HTTP/1.1
   Host: <target>

3. Retrieve credential files: If the instance is vulnerable, the server returns the file contents. Repeat for additional targets such as:
   • /webapps/xwiki/WEB-INF/xwiki.properties
   • /webapps/xwiki/WEB-INF/hibernate.cfg.xml
4. Extract credentials: Parse the returned configuration files for database connection strings, usernames, passwords, and other secrets contained within.
5. Leverage credentials: Use extracted database credentials to connect directly to the backend database, or use application credentials to authenticate to the XWiki instance with elevated privileges for further access (GitHub Advisory).

• Network: Unusual HTTP GET requests to paths matching /webapps/xwiki/WEB-INF/*.cfg or /webapps/xwiki/WEB-INF/*.xml from external or unexpected IP addresses; automated scanning patterns with rapid sequential requests to multiple WEB-INF file paths.
• Logs: Web server access logs showing 200 OK responses to requests for WEB-INF/xwiki.cfg, WEB-INF/xwiki.properties, or WEB-INF/hibernate.cfg.xml; repeated access attempts to configuration files from a single source IP.
• File System: No direct file system artifacts from exploitation (read-only access), but review for signs of subsequent unauthorized database access or new admin accounts created in XWiki following credential exposure.

XWiki has released patched versions 16.10.11, 17.4.4, and 17.7.0 that resolve this vulnerability by correcting the JETTY_BASE path resolution in start_xwiki.sh to use an absolute path instead of a relative one (GitHub Advisory). For organizations unable to upgrade immediately, the official workaround is to manually modify the start_xwiki.sh script following the changes in commits 42fb063 and 99a04a0. Additionally, organizations should implement network-level controls to restrict external access to the XWiki instance, audit and rotate any credentials that may have been exposed in xwiki.cfg, xwiki.properties, and hibernate.cfg.xml, and consider deploying a WAF rule to block requests targeting WEB-INF paths.

The vulnerability was reported by security researcher Joseph Huber and disclosed by XWiki maintainer tmortagne via GitHub Security Advisories on December 1, 2025 (GitHub Advisory). Community interest was reflected by the addition of Nuclei detection templates to the ProjectDiscovery nuclei-templates repository, indicating active interest from the security scanning community. Social media activity on Bluesky noted the vulnerability, though overall community reaction has been moderate given the absence of public exploits.