Most recent entries from all

bdu:2025-13433

EUVD-2026-251917

fkie_cve-2025-55748

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions 4.2-milestone-2 through 16.10.6, configuration files are accessible through jsx and sx endpoints. It's possible to access and read configuration files by using URLs such as `http://localhost:8080/bin/ssx/Main/WebHome?resource=../../WEB-INF/xwiki.cfg&minify=false`. This is fixed in version 16.10.7.

GHSA-m63c-3rmg-r2cf — XWiki configuration files can be accessed through jsx and sx endpoints

Affected: Maven: org.xwiki.platform:xwiki-platform-skin-skinx

### Impact

It's possible to get access and read configuration files by using URLs such as `http://localhost:8080/bin/ssx/Main/WebHome?resource=../../WEB-INF/xwiki.cfg&minify=false`.

This can apparently be reproduced on Tomcat instances.

### Patches

This has been patched in 17.4.0-rc-1, 16.10.7.

### Workarounds

There is no known workaround, other than upgrading XWiki.

### For more information

If you have any questions or comments about this advisory: * Open an issue in [Jira XWiki.org](https://jira.xwiki.org/) * Email us at [Security Mailing List](mailto:security@xwiki.org)

### Attribution

The vulnerability was reported by Gregor Neumann.

WID-SEC-W-2025-1967 — xwiki: Mehrere Schwachstellen ermöglichen Offenlegung von Informationen

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in xwiki ausnutzen, um Informationen offenzulegen.