Emerging wiki configuration exposure – path traversal surge not in KEV (yet)
The CrowdSec Network has detected a rapid increase in exploitation attempts targeting CVE-2025-55748, a path traversal vulnerability in XWiki Platform that allows attackers to read sensitive configuration files and potentially gain deeper access to internal systems.
Key findings
Vulnerability published Sept 3, 2025; CrowdSec began observing exploitation on Oct 31, 2025 with sustained escalation through Nov 11.
143 exploitation signals over 8 tracked days (31 October–Nov 11), with a peak of 35 in a single day and up to 13 distinct attacking sources
Not listed in the CISA Known Exploitation Vulnerability (KEV) catalog at the time of writing, heightening the chance organizations under‑prioritize patching while focused reconnaissance intensifies.
Patch: Upgrade immediately to XWiki 16.10.7 or later. If patching is delayed, restrict public access to /bin/ssx and /bin/sx endpoints via reverse proxy rules.
Preemptive blocking: Deploy CrowdSec with Application Security (WAF module) to automatically detect and stop CVE-2025-55748, using the virtual patching rule released on October 31, 2025.
