CVE-2025-46554

MEDIUM EXPLOITED NUCLEI

XWiki <14.10.22, <15.10.12, <16.4.3, <16.7.0 - Info Disclosure

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2025-46554 has been observed exploited in the wild (reported by VulnCheck KEV). A Nuclei detection template is also available.

Description

XWiki is a generic wiki platform. In versions starting from 1.8.1 to before 14.10.22, from 15.0-rc-1 to before 15.10.12, from 16.0.0-rc-1 to before 16.4.3, and from 16.5.0-rc-1 to before 16.7.0, anyone can access the metadata of any attachment in the wiki using the wiki attachment REST endpoint. There is no filtering for the results depending on current user rights, meaning an unauthenticated user could exploit this even in a private wiki. This issue has been patched in versions 14.10.22, 15.10.12, 16.4.3, and 16.7.0.

Nuclei Templates (1)

XWiki REST API - Attachments Disclosure
HIGHVERIFIEDby ritikchaddha
Shodan: html:"data-xwiki-reference"
FOFA: body="data-xwiki-reference"

References (5)

Core 5

Scores

CVSS v3 5.3
EPSS 0.0095
EPSS Percentile 56.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable yes
Technical Impact partial

Details

VulnCheck KEV 2025-09-04
CWE
CWE-862
Status published
Products (2)
org.xwiki.platform/xwiki-platform-rest-server 1.8.1 - 14.10.22Maven
xwiki/xwiki 1.8.1 - 14.10.22
Published Apr 30, 2025
Tracked Since Feb 18, 2026