CVE-2025-55748: XWiki Platform Path Traversal Vulnerability

CVE-2025-55748 Overview

CVE-2025-55748 is a critical path traversal vulnerability affecting XWiki Platform, a generic wiki platform offering runtime services for applications built on top of it. This vulnerability allows unauthenticated attackers to access and read sensitive configuration files through the jsx and ssx endpoints by manipulating URL parameters with directory traversal sequences.

The flaw exists in versions 4.2-milestone-2 through 16.10.6 of XWiki Platform. An attacker can exploit this vulnerability by crafting malicious URLs that include ../ sequences in the resource parameter, enabling them to traverse outside the intended directory and access files such as xwiki.cfg which may contain database credentials, encryption keys, and other sensitive configuration data.

Critical Impact

Unauthenticated attackers can read sensitive configuration files including database credentials, API keys, and encryption secrets, potentially leading to complete system compromise.

Affected Products

• XWiki Platform versions 4.2-milestone-2 through 16.10.6
• XWiki Platform 4.2 milestone2
• XWiki Platform 4.2 milestone3

Discovery Timeline

• 2025-09-03 - CVE-2025-55748 published to NVD
• 2025-09-10 - Last updated in NVD database

Technical Details for CVE-2025-55748

Vulnerability Analysis

This vulnerability is classified as CWE-23 (Relative Path Traversal), where the application fails to properly sanitize user-supplied input before using it to construct file paths. The ssx and jsx endpoints in XWiki Platform accept a resource parameter that is intended to load specific static resources. However, insufficient validation of this parameter allows attackers to include relative path traversal sequences (../) to navigate outside the intended resource directory.

When an attacker submits a request such as accessing the ssx endpoint with a resource parameter containing ../../WEB-INF/xwiki.cfg, the application processes the path without adequate sanitization. This allows the request to traverse up the directory structure and access the WEB-INF directory, which typically contains sensitive Java web application configuration files that should never be directly accessible to end users.

The vulnerability is particularly severe because it requires no authentication (network-accessible to anonymous users) and can expose critical configuration data including database connection strings, LDAP credentials, mail server configurations, and cryptographic keys used by the XWiki instance.

Root Cause

The root cause of CVE-2025-55748 lies in inadequate input validation within the resource handling logic of the ssx and jsx endpoints. These endpoints are designed to serve static resources like stylesheets and JavaScript files but fail to implement proper path canonicalization or directory traversal checks. The application does not verify that the resolved file path remains within the expected resource directory, allowing attackers to use relative path sequences to escape the intended directory boundary.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction, making exploitation straightforward for any attacker with network access to the vulnerable XWiki instance. An attacker can construct a malicious HTTP request targeting the ssx or jsx endpoints with a crafted resource parameter containing directory traversal sequences.

A typical exploitation scenario involves the attacker requesting URLs that include path traversal patterns to access sensitive files. For example, accessing the ssx endpoint under /bin/ssx/Main/WebHome with a resource parameter set to ../../WEB-INF/xwiki.cfg would retrieve the main XWiki configuration file. The minify=false parameter may be appended to ensure the response is returned in readable format rather than minified.

Detection Methods for CVE-2025-55748

Indicators of Compromise

• HTTP requests to /bin/ssx/ or /bin/jsx/ endpoints containing ../ sequences in the resource parameter
• Web server logs showing access attempts to paths containing WEB-INF, xwiki.cfg, hibernate.cfg.xml, or similar configuration file names
• Unusual access patterns to static resource endpoints from external IP addresses
• Error logs indicating file access attempts outside expected resource directories

Detection Strategies

• Deploy web application firewall (WAF) rules to detect and block path traversal patterns (../, ..%2f, %2e%2e/) in URL parameters
• Configure intrusion detection systems (IDS) to alert on requests containing path traversal sequences targeting the /bin/ssx/ and /bin/jsx/ endpoints
• Implement log analysis rules to identify HTTP requests with resource parameters containing suspicious path patterns
• Monitor for successful responses containing configuration file content signatures (e.g., xwiki.db., hibernate.connection.)

Monitoring Recommendations

• Enable detailed access logging for all XWiki web application endpoints and regularly review for anomalous patterns
• Set up real-time alerting for any requests matching path traversal signatures targeting XWiki endpoints
• Monitor file access patterns at the operating system level for unexpected reads of configuration files in the WEB-INF directory
• Implement network traffic analysis to detect potential data exfiltration of configuration file contents

How to Mitigate CVE-2025-55748

Immediate Actions Required

• Upgrade XWiki Platform to version 16.10.7 or later immediately, as this version contains the security fix
• If immediate upgrade is not possible, implement WAF rules to block requests containing path traversal sequences in the resource parameter
• Review web server and application logs for evidence of past exploitation attempts
• Rotate any credentials (database passwords, API keys, encryption secrets) that may have been exposed through configuration file access
• Restrict network access to XWiki instances to trusted IP ranges where possible

Patch Information

XWiki has released version 16.10.7 which addresses this vulnerability. The fix implements proper path validation to prevent directory traversal attacks through the ssx and jsx endpoints. Organizations should apply this update as their primary remediation strategy.

For detailed information about the fix, refer to the GitHub Security Advisory GHSA-m63c-3rmg-r2cf and the related commit. Additional tracking information is available at XWiki JIRA Issue XWIKI-23109.

Workarounds

• Configure reverse proxy or WAF rules to strip or reject requests containing ../ or URL-encoded variants in the resource parameter for /bin/ssx/ and /bin/jsx/ paths
• Apply filesystem permissions to restrict the XWiki application's read access to only necessary directories
• Implement network segmentation to limit exposure of XWiki instances to untrusted networks
• Consider temporarily disabling the ssx and jsx endpoints if they are not required for critical functionality (note: this may impact wiki styling and JavaScript features)

# Example Apache mod_rewrite rule to block path traversal attempts
RewriteEngine On
RewriteCond %{QUERY_STRING} (\.\.\/|\.\.%2f|%2e%2e) [NC]
RewriteRule ^/bin/(ssx|jsx)/ - [F,L]