CVE-2025-46554
XWiki missing authorization when accessing the wiki level attachments list and metadata via REST API
- 5.3MediumCVSS base score
- 1.1%Exploitation in 30 daysEPSS · top 35% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- 1Public exploitsMetasploit, Nuclei and Exploit-DB
Description
XWiki is a generic wiki platform. In versions starting from 1.8.1 to before 14.10.22, from 15.0-rc-1 to before 15.10.12, from 16.0.0-rc-1 to before 16.4.3, and from 16.5.0-rc-1 to before 16.7.0, anyone can access the metadata of any attachment in the wiki using the wiki attachment REST endpoint. There is no filtering for the results depending on current user rights, meaning an unauthenticated user could exploit this even in a private wiki. This issue has been patched in versions 14.10.22, 15.10.12, 16.4.3, and 16.7.0.
Public exploit
An exploit or proof of concept is public: anyone can try it against an unpatched system. The public collections list a Nuclei template for it. CISA's SSVC rates its exploitation: a proof of concept is public.
Show the exploits1
Nuclei templates1 template
- XWiki REST API - Attachments Disclosure (Nuclei template) (opens in a new tab)
http/cves/2025/CVE-2025-46554.yamlSeverity high
Modules, templates and exploits as listed by the Metasploit Framework (BSD-3-Clause), ProjectDiscovery's Nuclei templates (MIT) and the Exploit Database (GPLv2), read once a day. Where the data comes from
Timeline
ID reserved
By GitHub_M
- 6 days later
· 6 days later
Published
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| GitHub_MCNA (assigner) | 3.1 | Medium5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
| NVDNVD · Analyzed | 3.1 | Medium5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
- EPSS (exploitation in 30 days)
- 1.1% · top 35% of all CVEs (11 Nov 2026)
- CISA SSVC
- Exploitation: poc · Automatable: yes · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.3.
Affected products
- affected >= 1.8.1, < 14.10.22
- affected >= 15.0-rc-1, < 15.10.12
- affected >= 16.0.0-rc-1, < 16.4.3
- affected >= 16.5.0-rc-1, < 16.7.0
Affected packages
From reviewed advisories of the GitHub Advisory Database.
- Mavenorg.xwiki.platform:xwiki-platform-rest-serverGHSA-r5cr-xm48-97xp (opens in a new tab)
References
References5
- https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-r5cr-xm48-97xp (opens in a new tab)x_refsource_CONFIRM
- https://github.com/xwiki/xwiki-platform/commit/37ecea84fdd053c33733c2ae9a0778bf98eae608 (opens in a new tab)x_refsource_MISC
- https://github.com/xwiki/xwiki-platform/commit/a43e933ddeda17dad1772396e1757998260e9342 (opens in a new tab)x_refsource_MISC
- https://github.com/xwiki/xwiki-platform/commit/c02ce7843a39851865b9d7b6132e32fdd21e3856 (opens in a new tab)x_refsource_MISC
- https://jira.xwiki.org/browse/XWIKI-22424 (opens in a new tab)x_refsource_MISC
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2025-12749 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisory GHSA-r5cr-xm48-97xp (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2025-46554)Record last updated .