PT-2025-11972 · Xwiki · Xwiki Platform

Published 2025-03-19 · Updated 2025-03-20 · CVE-2025-29926

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions XWiki Platform versions prior to 15.10.15 XWiki Platform versions prior to 16.4.6 XWiki Platform versions prior to 16.10.0

Description The issue allows any user to exploit the WikiManager REST API to create a new wiki, potentially becoming an administrator and performing other attacks on the farm. The WikiManager REST API is not bundled in XWiki Standard by default and needs to be installed manually through the extension manager.

Recommendations For versions prior to 15.10.15, update to version 15.10.15 or later. For versions prior to 16.4.6, update to version 16.4.6 or later. For versions prior to 16.10.0, update to version 16.10.0 or later. As a temporary workaround, consider disabling the WikiManager REST API until a patch is available.

Exploit

Fix

LPE

Missing Authorization

Improper Authorization

Weakness Enumeration

CWE-862

CWE-285

Related Identifiers

BDU:2025-05154

CVE-2025-29926

GHSA-GFP2-6QHM-7X43

Affected Products

Xwiki Platform

References · 23

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/29xxx/CVE-2025-29926.json · Exploit
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-gfp2-6qhm-7x43 · Vendor Advisory
• https://github.com/xwiki/xwiki-platform/commit/82aa670106c7f5e6238ca6ed59a52d1800e05b99 · Patch
• https://bdu.fstec.ru/vul/2025-05154 · Security Note
• https://osv.dev/vulnerability/CVE-2025-29926 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-29926 · Security Note
• https://jira.xwiki.org/browse/XWIKI-22490 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-gfp2-6qhm-7x43 · Vendor Advisory
• https://github.com/xwiki/xwiki-platform · Note
• https://twitter.com/centry_agent/status/1902617535402668320 · Twitter Post
• https://twitter.com/centry_agent/status/1902669939884130758 · Twitter Post
• https://twitter.com/CVEnew/status/1902417441927709084 · Twitter Post
• https://t.me/cvedetector/20661 · Telegram Post
• https://twitter.com/centry_agent/status/1902702166655242501 · Twitter Post
• https://twitter.com/centry_agent/status/1902593360470405550 · Twitter Post