This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.

[TLP:CLEAR] XWiki fixes 3 vulnerabilities

XWiki fixes 3 vulnerabilities with versions 16.4.8, 16.10.7 and 17.4.0-rc-1 [1][2][3].

XWiki - configuration file disclosure (CVE-2025-55747)
CVSS 9.3 (Critical)

Through the WebJars API, by exploiting faulty handling of the "/" character in certain URLs, an unauthenticated remote attacker can gain access to configuration files [1].

The vulnerability is present in product:

  • XWiki; >=6.1-milestone-2, <16.10.7;

CVSS: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

More information:

The vulnerability was publicly disclosed 3. 9. 2025.

XWiki - configuration file disclosure (CVE-2025-55748)
CVSS 9.3 (Critical)

Through the JSX/SSX endpoints, using certain URLs, an unauthenticated remote attacker can gain access to configuration files [2].

The vulnerability is present in product:

  • XWiki; >=4.2-milestone-2, <16.10.7;

CVSS: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

More information:

The vulnerability was publicly disclosed 3. 9. 2025.

XWiki - sensitive information disclosure (CVE-2025-58049)
CVSS 5.8 (Medium)

Because the encryption key is stored in the same directory as the PDF export state (job status) containing user cookies with login credentials, an authenticated remote attacker can decrypt these credentials without authorization [3][4].

The vulnerability is present in product:

  • XWiki; >=14.4.2, <16.4.8; >=16.5.0-rc-1, <16.10.7; >=17.0.0-rc-1, <17.4.0-rc-1;

CVSS: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N

More information:

  • CVE-2025-58049 at cve.org, NVD
  • CWE-212: Improper Removal of Sensitive Information Before Storage or Transfer at cwe.mitre.org

The vulnerability was publicly disclosed 28. 8. 2025.

By CESNET, z.s.p.o. Michaela Ručková on 5. 9. 2025.

CESNET, z.s.p.o. Logo