CVE-2025-55749

HighCVSS 7.5/10Last modified Sep 26, 2026

Description

XWiki is an open-source wiki software platform. From 16.7.0 to 16.10.11, 17.4.4, or 17.7.0, in an instance which is using the XWiki Jetty package (XJetty), a context is exposed to statically access any file located in the webapp/ folder. It allows accessing files which might contains credentials. Fixed in 16.10.11, 17.4.4, and 17.7.0.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-284

Affected software

Vendor	Product	Versions
xwiki	xwiki-platform	>= 16.7.0, < 16.10.11; >= 17.0.0-rc1, < 17.4.4; >= 17.5.0, < 17.7.0

References

Timeline

Published: Dec 1, 2025
Last modified: Sep 26, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-55759.8A vulnerability classified as critical was found in PHPGurukul Dairy Farm Shop Management System 1.3. This vulnerability affects unknown cod CVE-2025-557506.5Gitpod is a developer platform for cloud development environments. In versions before main-gha.33628 for both Gitpod Classic and Gitpod Clas CVE-2025-557515.1OnboardLite is the result of the Influx Initiative, our vision for an improved student organization lifecycle at the University of Central F CVE-2025-557527.5Relative Path Traversal vulnerability in Apache Tomcat. The fix for bug 60013 introduced a regression where the rewritten URL was nor CVE-2025-557537.5An integer overflow in the case of failed ACME certificate renewal leads, after a number of failures (~30 days in default configurations), t CVE-2025-557549.6Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. Tomcat did not escape ANSI escape sequences i CVE-2025-557576.1A unauthenticated reflected XSS vulnerability in VirtueMart 1.0.0-4.4.10 for Joomla was discovered.CVE-2025-557585.4Multiple CSRF attack vectors in JDownloads component 1.0.0-4.0.47 for Joomla were discovered.CVE-2025-55769.8A vulnerability, which was classified as critical, has been found in PHPGurukul Dairy Farm Shop Management System 1.3. This issue affects so CVE-2025-557637.5Buffer Overflow in the URI parser of CivetWeb 1.14 through 1.16 (latest) allows a remote attacker to achieve remote code execution via a cra CVE-2025-55779.8A vulnerability, which was classified as critical, was found in PHPGurukul Dairy Farm Shop Management System 1.3. Affected is an unknown fun CVE-2025-55789.8A vulnerability has been found in PHPGurukul Dairy Farm Shop Management System 1.3 and classified as critical. Affected by this vulnerabilit