CVE-2025-55747: XWiki configuration files can be accessed through the webjars API

The vulnerability is a classic path traversal issue (CWE-23) where user-controlled input from the URL is used to construct file paths for resource loading. The core of the problem lies in the application's failure to properly sanitize and validate the resource paths before accessing them. The provided patch addresses this by introducing a centralized utility, ClassLoaderUtils, which is now used across different parts of the application to safely load resources. The analysis of the commit 9e7b4c03f2143978d891109a17159f73d4cdd318 clearly shows the replacement of direct, unsafe calls to getResourceAsStream and flawed manual path validation with calls to this new, safer utility. The vulnerable functions were identified by locating where these unsafe calls were made. Specifically, WebJarsResourceReferenceHandler.getResourceStream, InternalTemplateManager.getClassloaderTemplate, and SxResourceSource.getContent were all found to be constructing resource paths with user-controllable data without adequate sanitization, making them the primary entry points for this vulnerability.