CVE-2025-55749: XWiki Jetty Package (XJetty) allows accessing any application file through URL
(updated )
In an instance which is using the XWiki Jetty package (XJetty), a context is exposed to statically access any file located in the webapp/ folder.
It allows accessing files which might contains credentials, like http://myhots/webapps/xwiki/WEB-INF/xwiki.cfg, http://myhots/webapps/xwiki/WEB-INF/xwiki.properties or http://myhots/webapps/xwiki/WEB-INF/hibernate.cfg.xml.
References
- github.com/advisories/GHSA-53gx-j3p6-2rw9
- github.com/xwiki/xwiki-platform
- github.com/xwiki/xwiki-platform/commit/42fb063749dd88cc78196f72d7318b7179285ebd
- github.com/xwiki/xwiki-platform/commit/99a04a0e2143583f5154a43e02174155da7e8e10
- github.com/xwiki/xwiki-platform/compare/8b68d8a70b43f25391b3ee48477d7eb71b95cf4b...99a04a0e2143583f5154a43e02174155da7e8e10
- github.com/xwiki/xwiki-platform/security/advisories/GHSA-53gx-j3p6-2rw9
- jira.xwiki.org/browse/XWIKI-23438
- nvd.nist.gov/vuln/detail/CVE-2025-55749
Code Behaviors & Features
Detect and mitigate CVE-2025-55749 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →