CVE-2025-55749

HIGH EXPLOITED NUCLEI

XWiki <16.10.11, 17.4.4, 17.7.0 - Info Disclosure

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2025-55749 has been observed exploited in the wild (reported by VulnCheck KEV). A Nuclei detection template is also available.

Description

XWiki is an open-source wiki software platform. From 16.7.0 to 16.10.11, 17.4.4, or 17.7.0, in an instance which is using the XWiki Jetty package (XJetty), a context is exposed to statically access any file located in the webapp/ folder. It allows accessing files which might contains credentials. Fixed in 16.10.11, 17.4.4, and 17.7.0.

Nuclei Templates (1)

XWiki - Information Disclosure
HIGHVERIFIEDby DhiyaneshDk
FOFA: app="XWIKI-Platform"

References (5)

Core 5

Scores

CVSS v3 7.5
EPSS 0.0123
EPSS Percentile 79.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

VulnCheck KEV 2026-01-14
CWE
CWE-284
Status published
Products (3)
org.xwiki.platform/xwiki-platform-tool-jetty-resources 16.7.0 - 16.10.11Maven
xwiki/wiki-platform 16.7.0 - 16.10.11
xwiki/xwiki 16.7.0 - 16.10.11
Published Dec 01, 2025
Tracked Since Feb 18, 2026