~ / search / GHSA-m63c-3rmg-r2cf

GHSA-m63c-3rmg-r2cf

XWiki configuration files can be accessed through jsx and sx endpoints

Source: GitHub Advisory Database (reviewed) Critical CVE-2025-55748

Packages

EcosystemPackageAffectedFixed in
Maven org.xwiki.platform:xwiki-platform-skin-skinx >= 4.2-milestone-2, < 16.10.7 16.10.7

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact It's possible to get access and read configuration files by using URLs such as `http://localhost:8080/bin/ssx/Main/WebHome?resource=../../WEB-INF/xwiki.cfg&minify=false`. This can apparently be reproduced on Tomcat instances. ### Patches This has been patched in 17.4.0-rc-1, 16.10.7. ### Workarounds There is no known workaround, other than upgrading XWiki. ### For more information If you have any questions or comments about this advisory: * Open an issue in [Jira XWiki.org](https://jira.xwiki.org/) * Email us at [Security Mailing List](mailto:[email protected]) ### Attribution The vulnerability was reported by Gregor Neumann.

References

External links from the advisory. They lead to third-party sites.