CVE-2025-55747: XWiki Path Traversal Vulnerability

CVE-2025-55747 Overview

CVE-2025-55747 is a critical path traversal vulnerability in XWiki Platform, a generic wiki platform offering runtime services for applications built on top of it. The vulnerability allows unauthenticated remote attackers to access sensitive configuration files through the webjars API due to improper resource validation. This flaw affects versions from 6.1-milestone-2 through 16.10.6 and has been addressed in version 16.10.7.

Critical Impact

Unauthenticated attackers can remotely access sensitive configuration files, potentially exposing database credentials, API keys, and other critical system information that could lead to full system compromise.

Affected Products

• XWiki Platform versions 6.1-milestone-2 through 16.10.6
• XWiki Platform version 6.1-rc1
• All XWiki installations using the webjars API functionality

Discovery Timeline

• 2025-09-03 - CVE-2025-55747 published to NVD
• 2025-09-10 - Last updated in NVD database

Technical Details for CVE-2025-55747

Vulnerability Analysis

This vulnerability is classified as CWE-23 (Relative Path Traversal), which occurs when the application fails to properly validate user-supplied input used in file path operations. The XWiki Platform's webjars API endpoint accepts resource references that are not adequately sanitized, allowing attackers to traverse directory structures and access files outside the intended webjar resource directories.

The vulnerability enables network-based attacks without requiring authentication or user interaction. An attacker can craft malicious requests to the webjars API that include path traversal sequences, potentially accessing sensitive configuration files such as xwiki.cfg, xwiki.properties, or Hibernate configuration files containing database credentials.

Root Cause

The root cause lies in insufficient resource validation within XWiki's internal template management and servlet resource reference handling. The application did not properly validate or sanitize resource paths before serving files through the webjars API, allowing relative path traversal attacks to escape the intended resource directory context.

Attack Vector

The attack vector is network-based and requires no authentication. An attacker can send crafted HTTP requests to the webjars API endpoint with manipulated path parameters. By including path traversal sequences (such as ../), the attacker can navigate outside the legitimate webjar resource directories and access arbitrary files readable by the XWiki application, including sensitive configuration files that may contain credentials and system secrets.

// Security patch improving resource validation
// Source: GitHub Commit - InternalTemplateManager.java

import org.xwiki.cache.CacheException;
import org.xwiki.cache.CacheManager;
import org.xwiki.cache.config.LRUCacheConfiguration;
+import org.xwiki.classloader.internal.ClassLoaderUtils;
import org.xwiki.component.annotation.Component;
import org.xwiki.component.manager.ComponentLifecycleException;
import org.xwiki.component.manager.ComponentLookupException;

Source: GitHub Commit Change

// Security patch improving error handling in AbstractServletResourceReferenceHandler.java

                    sendError(HttpStatus.SC_NOT_FOUND, "Resource not found [%s].",
                        getResourceName(typedResourceReference));
                }
-            } catch (IOException | ResourceReferenceHandlerException e) {
+            } catch (Exception e) {
                this.logger.error(e.getMessage(), e);
                sendError(HttpStatus.SC_INTERNAL_SERVER_ERROR, e.getMessage());
            }

Source: GitHub Commit Change

Detection Methods for CVE-2025-55747

Indicators of Compromise

• Unusual HTTP requests to webjars API endpoints containing path traversal sequences (../, ..%2f, %2e%2e/)
• Web server access logs showing requests attempting to access configuration files like xwiki.cfg, xwiki.properties, or hibernate.cfg.xml
• Multiple failed or successful requests to /xwiki/webjars/ endpoints with encoded or double-encoded path components

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block path traversal patterns in requests to webjars endpoints
• Configure intrusion detection systems (IDS) to alert on requests containing directory traversal sequences targeting XWiki resources
• Review web server access logs for anomalous patterns targeting the webjars API with suspicious path parameters
• Deploy endpoint detection and response (EDR) solutions to monitor for unauthorized file access attempts

Monitoring Recommendations

• Enable verbose logging for XWiki webjars API requests and monitor for access attempts to sensitive file paths
• Set up real-time alerting for HTTP 500 errors from the webjars handler that may indicate exploitation attempts
• Monitor for unusual outbound data transfers that could indicate successful exfiltration of configuration data

How to Mitigate CVE-2025-55747

Immediate Actions Required

• Upgrade XWiki Platform to version 16.10.7 or later immediately
• If immediate upgrade is not possible, implement WAF rules to block path traversal patterns in webjars requests
• Review XWiki configuration files for any sensitive credentials that may have been exposed
• Rotate all credentials stored in XWiki configuration files as a precautionary measure

Patch Information

XWiki has released version 16.10.7 which addresses this vulnerability by improving resource validation in the internal template manager and servlet resource reference handler. The fix introduces proper path validation using ClassLoaderUtils and improves exception handling to prevent information leakage. Organizations should upgrade to version 16.10.7 or later. Detailed patch information is available in the GitHub Security Advisory GHSA-qww7-89xh-x7m7 and the associated XWiki Jira Issue XWIKI-19350.

Workarounds

• Deploy a reverse proxy or web application firewall to filter requests containing path traversal sequences before they reach XWiki
• Restrict network access to the XWiki installation to trusted IP ranges only
• Disable or restrict access to the webjars API if not required for your deployment

# Example: Apache mod_rewrite rule to block path traversal attempts
RewriteEngine On
RewriteCond %{REQUEST_URI} \.\./|\.\.%2f|%2e%2e/ [NC]
RewriteCond %{REQUEST_URI} ^/xwiki/webjars/ [NC]
RewriteRule .* - [F,L]