CVE-2025-55748: XWiki Platform Skin Skinx Vulnerability Allows Unauthorized Access to Configuration Files
Summary
CVE-2025-55748: XWiki configuration files can be accessed through jsx and sx endpoints. Affects org.xwiki.platform:xwiki-platform-skin-skinx versions >= 4.2-milestone-2, < 16.10.7. Fixed in 16.10.7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The XWiki Platform Skin Skinx is a Maven package that provides a skin for XWiki, a popular open-source wiki platform. This package is designed to enhance the user interface and experience of XWiki installations. However, it has been found to have a critical vulnerability that allows unauthorized access to sensitive configuration files, posing a significant security risk to users.
Vulnerability Detail
The vulnerability, identified as CVE-2025-55748, allows attackers to access and read sensitive configuration files through specially crafted URLs. For example, an attacker could exploit the vulnerability by accessing a URL like http://localhost:8080/bin/ssx/Main/WebHome?resource=../../WEB-INF/xwiki.cfg&minify=false. This issue primarily affects Tomcat instances and can lead to exposure of sensitive information, including configuration settings that could be leveraged for further attacks.
How To Fix
Minimum fixed version
16.10.7
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for this vulnerability other than upgrading to the patched version of the package.
Conclusion
The CVE-2025-55748 vulnerability in the XWiki Platform Skin Skinx poses a significant risk by allowing unauthorized access to sensitive configuration files. Users are strongly advised to upgrade to the patched version to ensure the security of their applications.
See every vulnerability recorded for org.xwiki.platform:xwiki-platform-skin-skinx →
FAQ
CVE-2025-55748 is a critical vulnerability in the XWiki Platform Skin Skinx that allows unauthorized access to configuration files.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software by analyzing the pom.xml file. You can also check your application using the Vulert playground at Vulert Scanner without any signup.
The vulnerability can lead to exposure of sensitive configuration files, which may contain critical information that could be exploited by attackers.
Yes, the vulnerability has been patched in version 16.10.7 of the XWiki Platform Skin Skinx package.
While there are no known workarounds, it is crucial to prioritize upgrading to the patched version to mitigate the risk of exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.xwiki.platform:xwiki-platform-skin-skinx.
