XWiki CVE-2025-55749

Requires the target XWiki instance to be deployed using the XWiki Jetty package (XJetty); the flaw stems from Jetty's base directory resolution in start_xwiki.sh exposing the webapp/ folder for static access. It does NOT affect XWiki deployed as a WAR on an independently configured servlet container (e.g., Tomcat). No authentication, user interaction, or special privileges are needed (PR:N/UI:N) - any remote user who can reach the web port can request WEB-INF files directly. Affected versions: 16.7.0-16.10.10, 17.0.0-rc1-17.4.3, and 17.5.0-17.6.x; fixed in 16.10.11, 17.4.4, and 17.7.0. Impact is limited to disclosure of files present under webapp/ (notably credential-bearing config files); no write or code-execution capability is granted directly.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N) describes a remote, unauthenticated, low-complexity flaw with high confidentiality impact and no integrity or availability impact - a pure information-disclosure issue, not a code-execution or auth-bypass one despite the misleading 'Authentication Bypass' tag. This is consistent with the description: the XJetty context statically serves any file under webapp/, exposing WEB-INF config files (xwiki.cfg, xwiki.properties, hibernate.cfg.xml) that may contain database and admin credentials. Real-world risk is elevated but conditional: exploitation is trivial (a single GET request) and a public POC exists, and the EPSS score of 1.77% (82nd percentile) is comparatively high, reflecting the low exploitation barrier. However, this is NOT in CISA KEV, so there is no confirmed active exploitation, and the flaw ONLY affects instances deployed via the XWiki Jetty package (XJetty) - WAR deployments on Tomcat/other servlet containers are unaffected. The 8.7 rating is CVSS 4.0; the equivalent 3.1 base is ~7.5. Net: a genuine, easy-to-exploit credential-exposure bug on affected deployments, but scope is limited to the XJetty distribution and impact is confidentiality-only, so it is a real-but-scoped priority rather than a universal critical.

A remote unauthenticated attacker sends a crafted URL such as http://host/webapps/xwiki/WEB-INF/xwiki.cfg or /WEB-INF/hibernate.cfg.xml to an XWiki instance running the XJetty package, and Jetty serves the raw configuration file. The returned files can contain database and administrative credentials, which the attacker then reuses to escalate access. A public exploit/POC and the fixed start_xwiki.sh diff are available, making reproduction straightforward.