Your RSA-2048 keys break in 2030. Find every one of them before attackers do.
☕ Maven
Not in CISA KEV

CVE-2025-55749 — xwiki-platform-tool-jetty…

Fix: xwiki/xwiki-platform@42fb063

CVE-2025-55749 is a CWE-284 vulnerability in org.xwiki.platform:xwiki-platform-tool-jetty-resources. A fix is available for org.xwiki.platform:xwiki-platform-tool-jetty-resources — see the affected versions and patch details below.

The XWiki Jetty package (XJetty) allows accessing any application file through URL

Also known asGHSA-53gx-j3p6-2rw9
Published
Dec 1, 2025
Updated
Aug 12, 2026
Affected
3 pkgs
Patched
3 / 3
Exploits
None indexed
Exploitation data as of Sep 22, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

Exploitation Status

No confirmed exploitation observed yet

  • CISA assesses this as automatable — exploitation doesn’t require manual, per-target effort, which raises the odds of mass scanning and opportunistic attacks.
  • CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.

Exploitation and automatability from CISA’s SSVC triage for CVE-2025-55749.

EPSS Exploitation Probability

via FIRST.org ↗
1.5%probability of exploitation in next 30 days
Lower Risk0.00%
Lower risk than most CVEs73th percentile — riskier than 73% of all scored CVEsHighest risk

EPSS (Exploit Prediction Scoring System) is a daily probability model maintained by FIRST.org. It estimates the likelihood a CVE will be exploited in production environments within the next 30 days, derived from real-world threat intelligence signals.

Real-World Exposure

3 pkgs affected
☕org.xwiki.platform:xwiki-platform-tool-jetty-resources☕org.xwiki.platform:xwiki-platform-tool-jetty-resources☕org.xwiki.platform:xwiki-platform-tool-jetty-resources

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Maven packages — download data is not available via public APIs for these ecosystems.

Description

Impact

In an instance which is using the XWiki Jetty package (XJetty), a context is exposed to statically access any file located in the webapp/ folder.

It allows accessing files which might contains credentials, like http://myhots/webapps/xwiki/WEB-INF/xwiki.cfg, http://myhots/webapps/xwiki/WEB-INF/xwiki.properties or http://myhots/webapps/xwiki/WEB-INF/hibernate.cfg.xml.

Patches

This has been patched in 16.10.11, 17.4.4, 17.7.0.

Workarounds

The workaround is to modify the start_xwiki.sh script following https://github.com/xwiki/xwiki-platform/compare/8b68d8a70b43f25391b3ee48477d7eb71b95cf4b...99a04a0e2143583f5154a43e02174155da7e8e10.

For more information

If you have any questions or comments about this advisory:

Attribution

Vulnerability reported by Joseph Huber.

Affected Packages

3 total 3 fixed
EcosystemPackageVulnerable rangeFix
☕Mavenorg.xwiki.platform:xwiki-platform-tool-jetty-resources≥ 16.7.0&&< 16.10.1116.10.11org.xwiki.platform:xwiki-platform-tool-jetty-resources:16.10.11
☕Mavenorg.xwiki.platform:xwiki-platform-tool-jetty-resources≥ 17.0.0-rc-1&&< 17.4.417.4.4org.xwiki.platform:xwiki-platform-tool-jetty-resources:17.4.4
☕Mavenorg.xwiki.platform:xwiki-platform-tool-jetty-resources≥ 17.5.0&&< 17.7.017.7.0org.xwiki.platform:xwiki-platform-tool-jetty-resources:17.7.0

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for org.xwiki.platform:xwiki-platform-tool-jetty-resources, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update org.xwiki.platform:xwiki-platform-tool-jetty-resources to 16.10.11 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2025-55749 is resolved across your whole dependency graph.

  3. Workarounds

    If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

  4. How O3 protects you

    O3 Security's impact-aware SCA analyses which vulnerable code paths your application actually calls, so a match like CVE-2025-55749 can be triaged on real exposure rather than presence alone.

Tailored to CVE-2025-55749. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.

How to detect CVE-2025-55749

A community-maintained Nuclei template exists for this CVE. You can scan for it directly:

nuclei -id cve-2025-55749 -u https://target
Template
XWiki - Information Disclosure
Severity
high
Impact
Attackers can access sensitive files including credentials, leading to information disclosure.
Remediation
Update to versions 16.10.11, 17.4.4, or 17.7.0 or later.

Template by ProjectDiscovery nuclei-templates (DhiyaneshDk), MIT licensed. View the full template. Scan only systems you are authorised to test.

Frequently Asked Questions

### Impact In an instance which is using the XWiki Jetty package (XJetty), a context is exposed to statically access any file located in the webapp/ folder. It allows accessing files which might contains credentials, like http://myhots/webapps/xwiki/WEB-INF/xwiki.cfg, http://myhots/webapps/xwiki/WEB-INF/xwiki.properties or http://myhots/webapps/xwiki/WEB-INF/hibernate.cfg.xml. ### Patches This has been patched in 16.10.11, 17.4.4, 17.7.0. ### Workarounds The workaround is to modify the start_xwiki.sh script following https://github.com/xwiki/xwiki-platform/compare/8b68d8a70b43f25391b3ee4
O3 Security · Impact-Aware SCA

Is CVE-2025-55749 in your dependencies?

O3 Security finds CVE-2025-55749 across Maven dependencies, including transitive ones, and its impact-aware SCA ranks findings by whether your code actually calls the vulnerable path.

Scan my dependencies How O3 SCA works
CVE-2025-55749: xwiki-platform-tool-jetty… | O3 Security