# CVE-2025-55748: XWiki-Platform - Path Traversal

> Live exploitation tracking for CVE-2025-55748 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2025-55748

## Key facts

- **Exploitation phase:** Background Noise. Continuous low-level scanning or exploitation attempts are observed, mostly opportunistic and automated.
- **CVSS score:** 9.3
- **Public exploit available:** Yes
- **Affected products:** XWiki-Platform
- **Weaknesses:** CWE-23 (Relative Path Traversal)
- **Tags:** wiki

## Description

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions 4.2-milestone-2 through 16.10.6, configuration files are accessible through jsx and sx endpoints. It's possible to access and read configuration files by using URLs such as `http://localhost:8080/bin/ssx/Main/WebHome?resource=../../WEB-INF/xwiki.cfg&minify=false`. This is fixed in version 16.10.7.

## CrowdSec analysis

[CVE-2025-55748](https://euvd.enisa.europa.eu/vulnerability/CVE-2025-55748) is a critical vulnerability in XWiki Platform versions 4.2-milestone-2 through 16.10.6 that allows unauthenticated attackers to access sensitive configuration files via specially crafted URLs targeting jsx and sx endpoints. Exploiting this flaw could expose confidential settings and credentials, potentially leading to further compromise of the affected system.

CrowdSec has been tracking this vulnerability and its exploits since 29th of October 2025.

CrowdSec network data shows that most actors exploiting CVE-2025-55748 rely on broad, untargeted scans with minimal filtering. The activity is largely automated and opportunistic in nature.
CrowdSec data also reveals a clear uptick in attacks involving CVE-2025-55748 over the past week. Activity is above the usual baseline, suggesting growing attention from attackers. This may reflect rising awareness, recent exploit releases, or expanded targeting efforts.

Attackers exploit the `/bin/ssx/Main/WebHome` endpoint with a `resource` parameter containing path traversal sequences (e.g., `../../WEB-INF/xwiki.cfg`) to read sensitive configuration files from vulnerable XWiki Platform instances.

## Timeline

- 2025-09-03: CVE Published. CVE-2025-55748 is published to NVD.
- 2025-10-29: Rule Released. CrowdSec releases a rule to detect CVE-2025-55748 exploitation attempts against the CrowdSec Network.
- 2025-10-31: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2025-55748 for the first time.

## References

- https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-m63c-3rmg-r2cf
- https://jira.xwiki.org/browse/XWIKI-23109
- https://github.com/xwiki/xwiki-platform/commit/9e7b4c03f2143978d891109a17159f73d4cdd318#diff-ee78930a9ac5ea586179fe8ab88a5fd58e369d175927d1e88a0b4dbc3ebcbf1eR62
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-55748.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2025-55748) follows observed exploitation activity for CVE-2025-55748. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.