CVE-2025-55747: Critical Config File Exposure in XWiki Platform

CVE-2025-55747 is a critical severity (9.1) relative path traversal in the XWiki Platform webjars API that lets configuration files be read. The record gives 16.10.7 as the fix, and the GitHub advisory also lists 17.4.0-rc-1. Upgrade to a patched release and then review what those files held.

What's affected

The CVE record says XWiki Platform versions 6.1-milestone-2 through 16.10.6 expose configuration files through the webjars API, fixed in 16.10.7. The GitHub advisory (GHSA-qww7-89xh-x7m7) is more detailed. It lists the xwiki-platform-webjars package as affected from 6.1-milestone-2 through 7.1.3 with no patched release, and the xwiki-platform-webjars-api package as affected from 7.1.4, with fixes in 16.10.7 and 17.4.0-rc-1. The record and the advisory differ on the exact ranges and on the 17.x fix, so use the advisory and the XWiki release notes for your line.

The advisory describes a path traversal in which a crafted webjars URL carries encoded slashes. The server decodes them when parsing the URL segment but not when building the file path. That can expose files outside the intended directory, such as WEB-INF/xwiki.cfg. No workaround is listed. The advisory says the remedy is upgrading XWiki.

The CVSS 3.1 vector in the record is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. The advisory gives its own CVSS 4.0 score of 9.3. The CVE is not on the CISA KEV list.

How to check if you're exposed

1. Check the XWiki version in the administration section or the footer of the wiki.
2. Compare it with 16.10.7 for the 16.x line and 17.4.0-rc-1 for 17.x.
3. If you build XWiki with Maven, run mvn dependency:tree | grep xwiki-platform-webjars to see which webjars artifact and version you carry.
4. Check whether your wiki is reachable from the internet, and whether a reverse proxy filters encoded slashes in paths.
5. Check what the file WEB-INF/xwiki.cfg and related files contain on your system, since that is what could be exposed.

Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan. It is built for package manifests, so it will not see a standalone server or a PHP project you downloaded as a zip. For those, an asset inventory of what you run is the starting point. Java dependencies such as the XWiki webjars artifacts do show up in a Maven manifest scan.

What to do now

1. Upgrade XWiki to 16.10.7, 17.4.0-rc-1 or a later release, as appropriate to your line.
2. After upgrading, treat any secret in the configuration files as potentially read. Rotate database passwords, keys and tokens stored there.
3. Review web server logs for webjars requests that contain encoded slashes or traversal patterns.
4. If you cannot upgrade immediately, restrict access to the wiki to trusted networks.
5. Keep configuration secrets in environment variables or a secrets store where your setup allows it, so a file read exposes less.

Why it matters

The class is CWE-23: relative path traversal. The program builds a file path from a value that the requester controls and fails to confine it to the intended directory. Mismatched decoding, where one layer decodes input and another does not, is a classic way for the check and the use to disagree.

Configuration files commonly hold database credentials and keys. A read only flaw can still be the first step into the rest of the system, which explains the high scores. The first thing to do after patching is to rotate what was exposed.

Try it yourself

Click through it at your own pace, or open it full screen.

Quick check

Sources

• https://github.com/xwiki/xwiki-platform/commit/9e7b4c03f2143978d891109a17159f73d4cdd318#diff-45ea9c87d5fb68cd5db0da7f78cf25e76f1325f5fe56e21618b21786fc706236R80-R81 (listed in the CVE record)
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-qww7-89xh-x7m7 (fetched for this post)
• https://jira.xwiki.org/browse/XWIKI-19350 (listed in the CVE record)
• Safeguard Gold entry for CVE-2025-55747

Last reviewed: 18 October 2026.