CVE-2025-55748: XWiki configuration files can be accessed through jsx and sx endpoints
N/A
Basic Information
JavaTechnical Details
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.xwiki.platform:xwiki-platform-skin-skinx | maven | >= 4.2-milestone-2, < 16.10.7 | 16.10.7 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The vulnerability lies in multiple locations within the XWiki platform where user-provided resource paths are used to access files from the classpath without proper sanitization. This allows for path traversal attacks, enabling an attacker to read sensitive configuration files like xwiki.cfg.
The analysis of the patch 9e7b4c03f2143978d891109a17159f73d4cdd318 reveals a clear pattern: multiple methods that were previously using ClassLoader.getResource() or ClassLoader.getResourceAsStream() with unsanitized input have been updated to use a new utility, ClassLoaderUtils. This utility centralizes path validation and prevents traversal outside of the intended directories.
The key vulnerable functions identified are:
com.xpn.xwiki.internal.template.InternalTemplateManager.getClassloaderTemplate: This function had a manual and flawed path traversal check that could be bypassed.com.xpn.xwiki.web.sx.SxResourceSource.getContent: This function handled requests to the/sx/endpoint and directly used a user-controlled resource name to fetch files.org.xwiki.webjars.internal.WebJarsResourceReferenceHandler.getResourceStream: This function handled requests for webjar resources and was vulnerable in how it constructed the resource path from user input.
By exploiting these functions through crafted URLs, an attacker could gain access to sensitive system information, as demonstrated by the added test cases which attempt to read WEB-INF/xwiki.cfg.