Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2025-46554— XWiki missing authorization when accessing the wiki level attachments list and metadata via REST API

Quick assessment

Affected

xwiki xwiki-platform

Exploitation

Public or AI PoC available; prioritize validation

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

XWiki Platform是XWiki开源的一套用于创建Web协作应用程序的Wiki平台。 XWiki Platform存在安全漏洞，该漏洞源于附件元数据访问控制不当，可能导致信息泄露。以下版本受到影响：1.8.1至14.10.22之前版本、15.0-rc-1至15.10.12之前版本、16.0.0-rc-1至16.4.3之前版本和16.5.0-rc-1至16.7.0之前版本。

CVSS 5.3 · Medium EPSS 1.07% · P65 Updated May 01, 2025

Public Exploits 1

Nuclei · 1 CVE-2025-46554.yaml [template]

Possible ATT&CK Techniques 1 AI

T1005 · Data from Local System

Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2025-46554

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

XWiki missing authorization when accessing the wiki level attachments list and metadata via REST API

Source: CVE Program / CVE List V5

Vulnerability Description

XWiki is a generic wiki platform. In versions starting from 1.8.1 to before 14.10.22, from 15.0-rc-1 to before 15.10.12, from 16.0.0-rc-1 to before 16.4.3, and from 16.5.0-rc-1 to before 16.7.0, anyone can access the metadata of any attachment in the wiki using the wiki attachment REST endpoint. There is no filtering for the results depending on current user rights, meaning an unauthenticated user could exploit this even in a private wiki. This issue has been patched in versions 14.10.22, 15.10.12, 16.4.3, and 16.7.0.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

授权机制缺失

Source: CVE Program / CVE List V5

Vulnerability Title

XWiki Platform 安全漏洞

Source: CNNVD (China National Vulnerability Database)

Vulnerability Description

Source: CNNVD (China National Vulnerability Database)

CVSS Information

N/A

Source: CNNVD (China National Vulnerability Database)

Vulnerability Type

N/A

Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
xwiki	xwiki-platform	>= 1.8.1, < 14.10.22	-

II. Public POCs for CVE-2025-46554

#	POC Description	Source Link	Shenlong Link
1	A vulnerability in XWiki's REST API allows unauthenticated users to access attachments list and metadata through the attachments endpoint. This could lead to disclosure of sensitive information stored in attachments metadata.	https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-46554.yaml	POC Details

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2025-46554

请登录查看更多情报信息。

Patches & Fixes for CVE-2025-46554 (4)

[XWIKI-22424] Anyone can access wiki attachments list and metadata via REST API - XWiki.org JIRA x_refsource_MISC
XWIKI-4135: Component override support does not work · xwiki/xwiki-platform@37ecea8 · GitHub x_refsource_MISC
XWIKI-22424: Improve attachment filtering · xwiki/xwiki-platform@c02ce78 · GitHub x_refsource_MISC
XWIKI-22424: Improve attachment filtering · xwiki/xwiki-platform@a43e933 · GitHub x_refsource_MISC

Vendor Advisories for CVE-2025-46554 (1)

Missing Authorization when accessing the wiki level attachments list and metadata via REST API · Advisory · xwiki/xwiki-platform · GitHub x_refsource_CONFIRM

https://www.cve.org/CVERecord?id=CVE-2025-46554

Same Patch Batch · xwiki · 2025-04-30 · 7 CVEs total

CVE-2025-32973	9.1 CRITICAL	org.xwiki.platform:xwiki-platform-component-wiki provides no warning when granting XWiki.C
CVE-2025-32974	9.1 CRITICAL	org.xwiki.platform:xwiki-platform-security-requiredrights-default required rights analysis
CVE-2025-32970	6.1 MEDIUM	org.xwiki.platform:xwiki-platform-wysiwyg-api Open Redirect vulnerability
CVE-2025-32971	3.8 LOW	XWiki Solr script service doesn't take dropped programming right into account
CVE-2025-32972	2.7 LOW	The lesscss script service allows cache clearing without programming right
CVE-2025-46557		Any user with view access to the XWiki space can change the authenticator

IV. Related Vulnerabilities

Same product: xwiki-platform

Same vendor: xwiki

Same weakness: CWE-862