PT-2025-47417 · Xwiki · Xwiki

Published 2025-11-18 · Updated 2025-11-20 · CVE-2025-65089

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions XWiki versions prior to 1.27.0

Description A user lacking view permissions on a page may be able to access the content of an office attachment displayed using the view file macro. This occurs when an office attachment from a restricted page is displayed on a public page. A proof of concept demonstrates that a user with restricted view rights can view the attachment content despite lacking the necessary permissions. There are no known workarounds available.

Recommendations Update to version 1.27.0 or later.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

BDU:2025-14683

CVE-2025-65089

GHSA-8C52-X9W7-VC95

Affected Products

Xwiki

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/65xxx/CVE-2025-65089.json · Exploit
• 🔥 https://github.com/xwikisas/xwiki-pro-macros/security/advisories/GHSA-8c52-x9w7-vc95 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-65089 · Security Note
• https://bdu.fstec.ru/vul/2025-14683 · Security Note
• https://osv.dev/vulnerability/GHSA-8c52-x9w7-vc95 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-65089 · Vendor Advisory
• https://github.com/xwikisas/xwiki-pro-macros · Note
• https://t.me/CVEtracker/37771 · Telegram Post
• https://reddit.com/r/VulnMatter/comments/1p1gf2n/resumen_diario_de_vulnerabilidades_19112025 · Reddit Post
• https://reddit.com/r/VulnMatter/comments/1p2foxr/resumen_diario_de_vulnerabilidades_20112025 · Reddit Post
• https://twitter.com/CVEnew/status/1991409473156424139 · Twitter Post