CVE-2025-29925

MEDIUM EXPLOITED NUCLEI

XWiki REST API - Private Pages Disclosure

Title source: nuclei
STIX 2.1

Exploitation Summary

CVE-2025-29925 has been observed exploited in the wild (reported by VulnCheck KEV). A Nuclei detection template is also available.

Description

XWiki Platform is a generic wiki platform. Prior to 15.10.14, 16.4.6, and 16.10.0-rc-1, protected pages are listed when requesting the REST endpoints /rest/wikis/[wikiName]/pages even if the user doesn't have view rights on them. It's particularly true if the entire wiki is protected with "Prevent unregistered user to view pages": the endpoint would still list the pages of the wiki, though only for the main wiki. The problem has been patched in XWiki 15.10.14, 16.4.6, 16.10.0RC1. In those versions the endpoint can still be requested but the result is filtered out based on pages rights.

Nuclei Templates (1)

XWiki REST API - Private Pages Disclosure
HIGHVERIFIEDby ritikchaddha
Shodan: html:"data-xwiki-reference"
FOFA: body="data-xwiki-reference"

References (5)

Core 5

Scores

CVSS v3 5.3
EPSS 0.0089
EPSS Percentile 54.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable yes
Technical Impact partial

Details

VulnCheck KEV 2025-09-04
CWE
CWE-402
Status published
Products (2)
org.xwiki.platform/xwiki-platform-rest-server 1.9M1 - 15.10.14Maven
xwiki/xwiki 1.9 - 15.10.14
Published Mar 19, 2025
Tracked Since Feb 18, 2026