Description
XWiki Jetty实例会公开一个上下文，允许静态访问位于 webapp/ 文件夹（特别是webapps/xwiki/WEB-INF/）中的任何文件。攻击者可以通过 URL 访问并下载可能包含敏感凭据的配置文件
XWiki Platform 文件读取漏洞(CVE-2025-55749)
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://nvd.nist.gov/vuln/detail/CVE-2025-55749
https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-53gx-j3p6-2rw9
https://www.ddpoc.com/DVB-2025-10410.html
https://cve.imfht.com/detail/CVE-2025-55749
https://www.sentinelone.com/vulnerability-database/cve-2025-55749/
https://bdziyi.com/60530/
https://pentest-tools.com/vulnerabilities-exploits/xwiki-information-disclosure_28307
https://cve.akaoma.com/cve-2025-55749