CVE-2025-55749
High · 7.5CVSS
7.5
EPSS
1.5%
Published
Dec 1, 2025
CISA due date
—
The record
XWiki is an open-source wiki software platform. From 16.7.0 to 16.10.11, 17.4.4, or 17.7.0, in an instance which is using the XWiki Jetty package (XJetty), a context is exposed to statically access any file located in the webapp/ folder. It allows accessing files which might contains credentials. Fixed in 16.10.11, 17.4.4, and 17.7.0.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Maven | org.xwiki.platform:xwiki-platform-tool-jetty-resources | 16.7.0 | 16.10.11 |
| Maven | org.xwiki.platform:xwiki-platform-tool-jetty-resources | 17.0.0-rc-1 | 17.4.4 |
| Maven | org.xwiki.platform:xwiki-platform-tool-jetty-resources | 17.5.0 | 17.7.0 |
| maven | org.xwiki.platform/xwiki-platform-tool-jetty-resources | 16.7.0 | 16.10.11 |
| maven | org.xwiki.platform/xwiki-platform-tool-jetty-resources | 17.0.0-rc-1 | 17.4.4 |
| maven | org.xwiki.platform/xwiki-platform-tool-jetty-resources | 17.5.0 | 17.7.0 |