CVSS 4.0
9.3 criticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:NCVE-2025-55747
Critical (9.3) in xwiki xwiki. EPSS 1.7% chance of exploitation in the next 30 days. Fixed in org.xwiki.platform:xwiki-platform-webjars-api 16.10.7, 17.4.0-rc-1.
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions 6.1-milestone-2 through 16.10.6, configuration files are accessible through the webjars API. This is fixed in version 16.10.7.
Severity
CVSS 3.1
9.1 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N- EPSS
- 1.7% chance of exploitation in the next 30 days; higher than 76% of CVEs (scores of 2026-10-31)
- CWE
- CWE-23
- Published
- Modified
- Record from
- the NVD, synced
Affected
- xwiki:xwiki
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-qww7-89xh-x7m7 | Maven | org.xwiki.platform:xwiki-platform-webjars-api | >=7.1.4 <16.10.7 | 16.10.7 |
| GHSA-qww7-89xh-x7m7 | Maven | org.xwiki.platform:xwiki-platform-webjars-api | >=17.0.0-rc-1 <17.4.0-rc-1 | 17.4.0-rc-1 |
| GHSA-qww7-89xh-x7m7 | Maven | org.xwiki.platform:xwiki-platform-webjars | >=6.1-miletone-2 <=7.1.3 | no fix published |