Your RSA-2048 keys break in 2030. Find every one of them before attackers do.
☕ Maven
Not in CISA KEV

CVE-2025-55747 — xwiki-platform-webjars-api

Fix: xwiki/xwiki-platform@9e7b4c0

CVE-2025-55747 is a CWE-23 vulnerability in org.xwiki.platform:xwiki-platform-webjars-api. A fix is available for org.xwiki.platform:xwiki-platform-webjars-api — see the affected versions and patch details below.

XWiki Platform's configuration files can be accessed through the webjars API

Also known asGHSA-qww7-89xh-x7m7
Published
Sep 3, 2025
Updated
Aug 12, 2026
Affected
3 pkgs
Patched
2 / 3
Exploits
None indexed
Exploitation data as of Sep 21, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

Exploitation Status

No confirmed exploitation observed yet

  • CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.

Exploitation and automatability from CISA’s SSVC triage for CVE-2025-55747.

EPSS Exploitation Probability

via FIRST.org ↗
1.7%probability of exploitation in next 30 days
Lower Risk0.00%
Lower risk than most CVEs76th percentile — riskier than 76% of all scored CVEsHighest risk

EPSS (Exploit Prediction Scoring System) is a daily probability model maintained by FIRST.org. It estimates the likelihood a CVE will be exploited in production environments within the next 30 days, derived from real-world threat intelligence signals.

Real-World Exposure

3 pkgs affected
☕org.xwiki.platform:xwiki-platform-webjars-api☕org.xwiki.platform:xwiki-platform-webjars-api☕org.xwiki.platform:xwiki-platform-webjars

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Maven packages — download data is not available via public APIs for these ecosystems.

Description

Impact

It's possible to get access and read configuration files by using URLs such as http://localhost:8080/xwiki/webjars/wiki%3Axwiki/..%2F..%2F..%2F..%2F..%2FWEB-INF%2Fxwiki.cfg. The trick here is to encode the / which is decoded when parsing the URL segment, but not re-encoded when assembling the file path.

Patches

This has been patched in 17.4.0-rc-1, 16.10.7.

Workarounds

There is no known workaround, other than upgrading XWiki.

References

For more information

If you have any questions or comments about this advisory:

Affected Packages

3 total 2 fixed
EcosystemPackageVulnerable rangeFix
☕Mavenorg.xwiki.platform:xwiki-platform-webjars-api≥ 7.1.4&&< 16.10.716.10.7org.xwiki.platform:xwiki-platform-webjars-api:16.10.7
☕Mavenorg.xwiki.platform:xwiki-platform-webjars-api≥ 17.0.0-rc-1&&< 17.4.0-rc-117.4.0-rc-1org.xwiki.platform:xwiki-platform-webjars-api:17.4.0-rc-1
☕Mavenorg.xwiki.platform:xwiki-platform-webjars≥ 6.1-miletone-2No fix

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for org.xwiki.platform:xwiki-platform-webjars-api, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update org.xwiki.platform:xwiki-platform-webjars-api to 16.10.7 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2025-55747 is resolved across your whole dependency graph.

  3. Workarounds

    If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

  4. How O3 protects you

    O3 Security's impact-aware SCA analyses which vulnerable code paths your application actually calls, so a match like CVE-2025-55747 can be triaged on real exposure rather than presence alone.

Tailored to CVE-2025-55747. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.

How to detect CVE-2025-55747

A community-maintained Nuclei template exists for this CVE. You can scan for it directly:

nuclei -id cve-2025-55747 -u https://target
Template
XWiki Platform - Information Disclosure
Severity
high
Impact
Remote attackers can access sensitive configuration files, potentially exposing critical information.
Remediation
Update to version 16.10.7 or later.

Template by ProjectDiscovery nuclei-templates (Redmomn), MIT licensed. View the full template. Scan only systems you are authorised to test.

Frequently Asked Questions

### Impact It's possible to get access and read configuration files by using URLs such as http://localhost:8080/xwiki/webjars/wiki%3Axwiki/..%2F..%2F..%2F..%2F..%2FWEB-INF%2Fxwiki.cfg. The trick here is to encode the / which is decoded when parsing the URL segment, but not re-encoded when assembling the file path. ### Patches This has been patched in 17.4.0-rc-1, 16.10.7. ### Workarounds There is no known workaround, other than upgrading XWiki. ### References * https://jira.xwiki.org/browse/XWIKI-19350 * https://github.com/xwiki/xwiki-platform/commit/9e7b4c03f2143978d891109a17159f73d4cd
O3 Security · Impact-Aware SCA

Is CVE-2025-55747 in your dependencies?

O3 Security finds CVE-2025-55747 across Maven dependencies, including transitive ones, and its impact-aware SCA ranks findings by whether your code actually calls the vulnerable path.

Scan my dependencies How O3 SCA works
CVE-2025-55747: xwiki-platform-webjars-api | O3 Security