CVE-2025-29925: xwiki — Exploit & Fix

Description

XWiki Platform is a generic wiki platform. Prior to 15.10.14, 16.4.6, and 16.10.0-rc-1, protected pages are listed when requesting the REST endpoints /rest/wikis/[wikiName]/pages even if the user doesn't have view rights on them. It's particularly true if the entire wiki is protected with "Prevent unregistered user to view pages": the endpoint would still list the pages of the wiki, though only for the main wiki. The problem has been patched in XWiki 15.10.14, 16.4.6, 16.10.0RC1. In those versions the endpoint can still be requested but the result is filtered out based on pages rights.

Is your site exposed to CVE-2025-29925?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

5.3

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness Type (CWE)

CWE-402 CWE-402

Affected Products

Vendor	Product	Versions
xwiki	xwiki	1.9 — 15.10.14
xwiki	xwiki	16.0.0 — 16.4.6
xwiki	xwiki	16.5.0 — 16.10.0

References

Advisories & Patches

https://github.com/xwiki/xwiki-platform/commit/1fb12d2780f37b34a1b4dfdf8457d97ce5cbb2df https://github.com/xwiki/xwiki-platform/commit/bca72f5ce971a31dba2a016d8dd8badda4475206 https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-22q5-9phm-744v https://jira.xwiki.org/browse/XWIKI-22630 https://jira.xwiki.org/browse/XWIKI-22639 https://jira.xwiki.org/browse/XWIKI-22630 https://jira.xwiki.org/browse/XWIKI-22639

Exploits

https://jira.xwiki.org/browse/XWIKI-22630 https://jira.xwiki.org/browse/XWIKI-22630

Frequently Asked Questions

What is CVE-2025-29925? +

XWiki Platform is a generic wiki platform. Prior to 15.10.14, 16.4.6, and 16.10.0-rc-1, protected pages are listed when requesting the REST endpoints /rest/wikis/[wikiName]/pages even if the user doesn't have view rights on them. It's particularly true if the entire wiki is protected with "Prevent unregistered user to view pages": the endpoint would still list the pages of the wiki, though only for the main wiki. The problem has been patched in XWiki 15.10.14, 16.4.6, 16.10.0RC1. In those versions the endpoint can still be requested but the result is filtered out based on pages rights. It has a CVSS v3.1 base score of 5.3 (MEDIUM).

How severe is CVE-2025-29925? +

CVE-2025-29925 has a CVSS v3.1 score of 5.3 out of 10, rated MEDIUM. This is a medium-severity vulnerability that should be remediated as part of regular maintenance.

What products are affected by CVE-2025-29925? +

CVE-2025-29925 affects products from xwiki, specifically: xwiki. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2025-29925? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2025-0502 9.1

Transmission of Private Resources into a New Sphere ('Resource Leak') vulnerability in CrafterCMS Engine on Linux, MacOS, x86, Windows, 64 …

CVE-2025-48383 8.2

Django-Select2 is a Django integration for Select2. Prior to version 8.4.1, instances of HeavySelect2Mixin subclasses like the ModelSelect2MultipleWidget and ModelSelect2Widget …

CVE-2024-29900 7.5

Electron Packager bundles Electron-based application source code with a renamed Electron executable and supporting files into folders ready for distribution. …

CVE-2025-67745 7.1

MyHoard is a daemon for creating, managing and restoring MySQL backups. Starting in version 1.0.1 and prior to version 1.3.0, …

CVE-2024-47146 6.5

Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x could allow an attacker to obtain the devices serial …

CVE-2025-49618 5.8

In Plesk Obsidian 18.0.69, unauthenticated requests to /login_up.php can reveal an AWS accessKeyId, secretAccessKey, region, and endpoint.

CVE-2025-29925