Description
XWiki Platform 4.2-milestone-2 至 16.10.6 存在路径遍历漏洞。该漏洞由于 jsx 和 sx 端点的访问控制不当，允许远程攻击者读取敏感的配置文件。此漏洞的利用不需要特殊权限，可能导致敏感系统信息的泄露。
XWiki Platform /bin/ssx/Main/WebHome 目录遍历漏洞（CVE-2025-55748）
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://nvd.nist.gov/vuln/detail/CVE-2025-55748
https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-m63c-3rmg-r2cf
https://jira.xwiki.org/browse/XWIKI-23109
https://www.crowdsec.net/vulntracking-report/cve-2025-55748
https://www.sonicwall.com/de-de/blog/critical-xwiki-sensitive-information-disclosure-vulnerability-cve-2025-55748-
https://www.sentinelone.com/vulnerability-database/cve-2025-55748/
https://blog.csdn.net/weixin_72305072/article/details/151186799
https://www.secrss.com/articles/82741
https://www.invicti.com/web-application-vulnerabilities/xwikiplatform-relative-path-traversal-vulnerability-cve-2025-55748