PT-2025-23334 · Unknown · Application-Urlshortener

Highkebabronin · Published 2025-05-30 · Updated 2025-05-30 · CVE-2025-48885

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions application-urlshortener versions prior to 1.2.4

Description The issue allows users with view access to create arbitrary pages, including guest users who do not have existing accounts. This can lead to the creation of a large number of pages with random names, making it difficult for administrators to manage the wiki structure.

Recommendations For versions prior to 1.2.4, update to version 1.2.4 to resolve the issue. As a temporary workaround, consider restricting access to the page creation feature to prevent guest users from creating arbitrary pages until the update is applied.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2025-48885

GHSA-C57G-9V2R-W8V3

Affected Products

Application-Urlshortener

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/48xxx/CVE-2025-48885.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-48885 · Security Note
• https://osv.dev/vulnerability/CVE-2025-48885 · Vendor Advisory
• https://github.com/xwikisas/application-urlshortener/commit/f121a9c973fd25948e82efcb6289d53fe00a9e7d · Note
• https://github.com/xwikisas/application-urlshortener/security/advisories/GHSA-c57g-9v2r-w8v3 · Note
• https://twitter.com/VulmonFeeds/status/1928561800842211510 · Twitter Post
• https://twitter.com/CVEnew/status/1928530095515513243 · Twitter Post
• https://t.me/cvetracker/25035 · Telegram Post