XWiki-Platform - Path Traversal (CVE-2025-55748)

CVE-2025-55748 is a critical vulnerability in XWiki Platform versions 4.2-milestone-2 through 16.10.6 that allows unauthenticated attackers to access sensitive configuration files via specially crafted URLs targeting jsx and sx endpoints. Exploiting this flaw could expose confidential settings and credentials, potentially leading to further compromise of the affected system.

CrowdSec has been tracking this vulnerability and its exploits since 29th of October 2025.

CrowdSec network data shows that most actors exploiting CVE-2025-55748 rely on broad, untargeted scans with minimal filtering. The activity is largely automated and opportunistic in nature. CrowdSec data also reveals a clear uptick in attacks involving CVE-2025-55748 over the past week. Activity is above the usual baseline, suggesting growing attention from attackers. This may reflect rising awareness, recent exploit releases, or expanded targeting efforts.

Attackers exploit the /bin/ssx/Main/WebHome endpoint with a resource parameter containing path traversal sequences (e.g., ../../WEB-INF/xwiki.cfg) to read sensitive configuration files from vulnerable XWiki Platform instances.