XWiki /bin/ssx/Main/WebHome 存在路径遍历漏洞

Description

PoC

None yet. Search at https://trap.biu.life/?ref=rss

References

• https://nvd.nist.gov/vuln/detail/CVE-2025-55748
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-m63c-3rmg-r2cf
• https://www.secevery.com/toBugInfo?id=1963495335353131009
• https://blog.csdn.net/weixin_72305072/article/details/151186799
• https://www.xtcaq.com/nd.jsp?id=9741
• https://www.secrss.com/articles/82741
• https://www.nsfocus.net/vulndb/125419
• https://www.crowdsec.net/vulntracking-report/cve-2025-55748
• https://www.cvedetails.com/cve/CVE-2025-55748/
• https://www.sentinelone.com/vulnerability-database/cve-2025-55748/
• https://jira.xwiki.org/browse/XWIKI-23109
• https://radar.offseq.com/threat/cve-2025-55748-cwe-23-relative-path-traversal-in-x-7dcdaae6

Related Vulnerabilities

• XWiki Platform /xwiki/bin/skin/ 目录遍历漏洞（CVE-2026-34151）
• XWiki /xwiki/rest/liveData/sources/liveTable/entries SQL 注入漏洞（CVE-2025-32429）
• XWiki /bin/jsx/Main/WebHome 目录遍历漏洞（CVE-2026-23734）
• PoCCVE-2026-40105: XWiki - Cross-Site Scripting
• XWiki存在XSS漏洞(CVE-2026-40105)
• PoCCVE-2026-24128: XWiki Platform Distribution Flavor Main - Cross-Site Scripting
• PoCCVE-2025-66472: XWiki DeleteApplication - Cross-Site Scripting
• PoCCVE-2025-55749: XWiki - Information Disclosure
• XWiki Jetty /webapps/xwiki/WEB-INF/web.xml 文件读取漏洞（CVE-2025-55749）
• XWiki Platform 文件读取漏洞(CVE-2025-55749)
• XWiki /rest/wikis/xwiki/query SQL 注入漏洞（CVE-2025-32969）