CVE-2025-29926
published 2025-03-19CVE-2025-29926: XWiki Platform is a generic wiki platform. Prior to 15.10.15, 16.4.6, and 16.10.0, any user can exploit the WikiManager REST API to create a new wiki, where…
PriorityP356critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.53%
40.9th percentile
XWiki Platform is a generic wiki platform. Prior to 15.10.15, 16.4.6, and 16.10.0, any user can exploit the WikiManager REST API to create a new wiki, where the user could become an administrator and so performs other attacks on the farm. Note that this REST API is not bundled in XWiki Standard by default: it needs to be installed manually through the extension manager. The problem has been patched in versions 15.10.15, 16.4.6 and 16.10.0 of the REST module.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| xwiki | xwiki | — | — |
| xwiki | xwiki | >= 16.0.0 < 16.4.6 | 16.4.6 |
| xwiki | xwiki | >= 16.5.0 < 16.10.0 | 16.10.0 |
| xwiki | xwiki | >= 5.4.1 < 15.10.15 | 15.10.15 |
| xwiki | xwiki-platform | — | — |
| xwiki | xwiki-platform | — | — |
| xwiki | xwiki-platform | — | — |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv4.07.9HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
The WikiManager REST API allows any user to create wikis
osv·2025-03-19
CVE-2025-29926 [HIGH] The WikiManager REST API allows any user to create wikis
The WikiManager REST API allows any user to create wikis
### Impact
Any user can exploit the WikiManager REST API to create a new wiki, where the user could become an administrator and so performs other attacks on the farm.
Note that this REST API is not bundled in XWiki Standard by default: it needs to be installed manually through the extension manager.
### Patches
The problem has been patched in versions 15.10.15, 16.4.6 and 16.10.0 of the REST module.
### Workarounds
There's no workaround other than upgrading the dependency.
### References
* JIRA ticket: https://jira.xwiki.org/browse/XWIKI-22490
* Commit of the fix: https://github.com/xwiki/xwiki-platform/commit/82aa670106c7f5e6238ca6ed59a52d1800e05b99
### For more information
If you have any questions or comments about this
GHSA
The WikiManager REST API allows any user to create wikis
ghsa·2025-03-19
CVE-2025-29926 [HIGH] CWE-285 The WikiManager REST API allows any user to create wikis
The WikiManager REST API allows any user to create wikis
### Impact
Any user can exploit the WikiManager REST API to create a new wiki, where the user could become an administrator and so performs other attacks on the farm.
Note that this REST API is not bundled in XWiki Standard by default: it needs to be installed manually through the extension manager.
### Patches
The problem has been patched in versions 15.10.15, 16.4.6 and 16.10.0 of the REST module.
### Workarounds
There's no workaround other than upgrading the dependency.
### References
* JIRA ticket: https://jira.xwiki.org/browse/XWIKI-22490
* Commit of the fix: https://github.com/xwiki/xwiki-platform/commit/82aa670106c7f5e6238ca6ed59a52d1800e05b99
### For more information
If you have any questions or comments about this
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-03-19
Published