CVE-2025-55749: XWiki

High severity, CVSS 7.5. EPSS: 1.5% chance of exploitation in the next 30 days.

XWiki is an open-source wiki software platform. From 16.7.0 to 16.10.11, 17.4.4, or 17.7.0, in an instance which is using the XWiki Jetty package (XJetty), a context is exposed to statically access any file located in the webapp/ folder. It allows accessing files which might contains credentials. Fixed in 16.10.11, 17.4.4, and 17.7.0.

Affected products

• XWiki XWiki: from 16.7.0, before 16.10.11 (fixed in 16.10.11); from 17.0.0, before 17.4.4 (fixed in 17.4.4); from 17.5.0, before 17.7.0 (fixed in 17.7.0)

Published 2025-12-01. Last modified 2026-09-26.