N/A

CVSS Score

-

CVSS Score

Basic Information

CVE ID

CVE-2025-55749

GHSA ID

GHSA-53gx-j3p6-2rw9

EPSS Score

CWE

CWE-284

Published

12/1/2025

Updated

12/1/2025

KEV Status

Technology

Java

Basic Information

CVE ID

GHSA ID

EPSS Score

CWE

Published

Updated

KEV Status

Technology

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-55749

CVE-2025-55749: XWiki Jetty Package (XJetty) allows accessing any application file through URL

Impact

In an instance which is using the XWiki Jetty package (XJetty), a context is exposed to statically access any file located in the webapp/ folder.

It allows accessing files which might contains credentials, like http://myhots/webapps/xwiki/WEB-INF/xwiki.cfg, http://myhots/webapps/xwiki/WEB-INF/xwiki.properties or http://myhots/webapps/xwiki/WEB-INF/hibernate.cfg.xml.

Patches

This has been patched in 16.10.11, 17.4.4, 17.7.0.

Workarounds

The workaround is to modify the start_xwiki.sh script following https://github.com/xwiki/xwiki-platform/compare/8b68d8a70b43f25391b3ee48477d7eb71b95cf4b...99a04a0e2143583f5154a43e02174155da7e8e10.

For more information

If you have any questions or comments about this advisory:

Open an issue in Jira XWiki.org
Email us at Security Mailing List

Attribution

Vulnerability reported by Joseph Huber.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-55749

CVE-2025-55749:

N/A

CVSS Score

-

CVSS Score

Basic Information

CVE ID

CVE-2025-55749

GHSA ID

GHSA-53gx-j3p6-2rw9

EPSS Score

CWE

CWE-284

Published

12/1/2025

Updated

12/1/2025

KEV Status

Technology

Java

Basic Information

CVE ID

GHSA ID

EPSS Score

CWE

Published

Updated

KEV Status

Technology

Technical Details

CVSS Vector

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
org.xwiki.platform:xwiki-platform-tool-jetty-resources	maven	>= 16.7.0, < 16.10.11	16.10.11
org.xwiki.platform:xwiki-platform-tool-jetty-resources	maven	>= 17.0.0-rc-1, < 17.4.4	17.4.4
org.xwiki.platform:xwiki-platform-tool-jetty-resources	maven	>= 17.5.0, < 17.7.0	17.7.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis:

In progress

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

N/A

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2025-55749: XWiki Jetty Package (XJetty) allows accessing any application file through URL

Impact

Patches

Workarounds

For more information

Attribution

CVE-2025-55749:

N/A

-

Basic Information

Basic Information

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

WAF Protection Rules

WAF Rule

Reasoning

Vulnerability IntelligenceMiggo AI

N/A

N/A

Basic Information

Basic Information

CVE-2025-55749: XWiki Jetty Package (XJetty) allows accessing any application file through URL

Impact

Patches

Workarounds

For more information

Attribution

Vulnerability IntelligenceMiggo AI

WAF Protection Rules

WAF Rule

Reasoning

Technical Details

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI