CVE-2025-55749
EUVD-2025-20007501.12.2025, 21:15
XWiki is an open-source wiki software platform. From 16.7.0 to 16.10.11, 17.4.4, or 17.7.0, in an instance which is using the XWiki Jetty package (XJetty), a context is exposed to statically access any file located in the webapp/ folder. It allows accessing files which might contains credentials. Fixed in 16.10.11, 17.4.4, and 17.7.0.Enginsight
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| xwiki | xwiki | 16.7.0 ≤ 𝑥 < 16.10.11 |
| xwiki | xwiki | 17.0.0 ≤ 𝑥 < 17.4.4 |
| xwiki | xwiki | 17.5.0 ≤ 𝑥 < 17.7.0 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References