CVE-2025-29925

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-29925
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-29925.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-29925
Aliases
Published
2025-03-19T17:36:28.066Z
Modified
2026-08-12T14:52:34.214505Z
Severity
  • 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
XWiki allows unregistered users to access private pages information through REST endpoint
Details

XWiki Platform is a generic wiki platform. Prior to 15.10.14, 16.4.6, and 16.10.0-rc-1, protected pages are listed when requesting the REST endpoints /rest/wikis/[wikiName]/pages even if the user doesn't have view rights on them. It's particularly true if the entire wiki is protected with "Prevent unregistered user to view pages": the endpoint would still list the pages of the wiki, though only for the main wiki. The problem has been patched in XWiki 15.10.14, 16.4.6, 16.10.0RC1. In those versions the endpoint can still be requested but the result is filtered out based on pages rights.

Database specific 
{
    "cwe_ids": [
        "CWE-402"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/29xxx/CVE-2025-29925.json",
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/xwiki/xwiki-commons

Affected ranges

Type
GIT
Repo
https://github.com/xwiki/xwiki-commons
Events
Introduced
89fd7db3a1579cf5b76271f00774b0349a782d16
Fixed
5a2b7a6776897660187239682caa6dc5467dd713
Introduced
918ea43fe0d277c28efa21a871175b329c75157c
Fixed
8c14d05055fc563d2838c2c9bb141e91d7401386
Introduced
526fcc68b3f75862a2af7395b5a6dfdd3d2166a5
Last affected
69d6e1ec9d9147f5dd6d5260bef78570d18e58bd
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*",
    "source": "CPE_RANGE",
    "extracted_events": [
        {
            "introduced": "1.9"
        },
        {
            "fixed": "15.10.14"
        },
        {
            "introduced": "16.0.0"
        },
        {
            "fixed": "16.4.6"
        },
        {
            "introduced": "16.5.0"
        },
        {
            "last_affected": "16.10.0"
        }
    ]
}
Type
GIT
Repo
https://github.com/xwiki/xwiki-platform
Events
Introduced
a744864303bb132a55800f5846c51233830abab1
Fixed
26b3bc4fcbf373467d4a70e7127a758dcc37c430
Introduced
3c6f5cf138d8095f63631e554ba448e4b780e162
Fixed
5292357f68df062a1b2f6a48410c3753e94771d3
Introduced
177e524c2e218fe5de776619271b7cd12c929488
Fixed
1fb12d2780f37b34a1b4dfdf8457d97ce5cbb2df
Fixed
bca72f5ce971a31dba2a016d8dd8badda4475206
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*",
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "1.9"
        },
        {
            "fixed": "15.10.14"
        },
        {
            "introduced": "16.0.0"
        },
        {
            "fixed": "16.4.6"
        },
        {
            "introduced": "16.5.0"
        },
        {
            "last_affected": "16.10.0"
        }
    ]
}

Database specific

vanir_signatures_modified 
"2026-08-12T14:52:34Z"
source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-29925.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "target": {
            "file": "xwiki-platform-core/xwiki-platform-rest/xwiki-platform-rest-server/src/main/java/org/xwiki/rest/internal/resources/wikis/WikiPagesResourceImpl.java",
            "function": "getPages"
        },
        "id": "CVE-2025-29925-9f3c8e6e",
        "signature_version": "v1",
        "digest": {
            "function_hash": "64311348435243966757755016930476573864",
            "length": 2890.0
        },
        "source": "https://github.com/xwiki/xwiki-platform/commit/bca72f5ce971a31dba2a016d8dd8badda4475206",
        "signature_type": "Function"
    },
    {
        "deprecated": false,
        "target": {
            "file": "xwiki-platform-core/xwiki-platform-rest/xwiki-platform-rest-server/src/main/java/org/xwiki/rest/internal/resources/wikis/WikiPagesResourceImpl.java"
        },
        "id": "CVE-2025-29925-cfa6f5e6",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "138549375513033347171623804982457570235",
                "70038226735964741497518173792036116166",
                "156182728382459651367634386820509449808",
                "3775358027659907671919885106945314928",
                "25364683297712809163374831299835604612",
                "33023829289153245841221348457636566212",
                "177779699407833604672352283748281317230",
                "324043755918073607820256991894091218108",
                "325591352857511821513179260995108954490",
                "279321189022915217726989129797285657610",
                "167060727297909357900851529283323898024",
                "103266549912198392022407230839160413570",
                "293249744413693438131946251074786208837",
                "54549870806189391583764999982908103400",
                "263478647662635162303716653708855371090",
                "307559450968905362458213000128358185918",
                "190206509270600805410246288542696869113",
                "247795608246211973244323214950094319548",
                "298145377215248422166197275138273827107",
                "201250076132878601625737412587247350475",
                "166900633162410745318912181870638072927",
                "52317517904041560120143649278859838736",
                "220336788550525974042909563675605881101",
                "153573633185587297402953936888214175342",
                "16065364730026839753756457000419947373",
                "279981998301468004667250114677291861825",
                "142121659439106328008811877225352946868",
                "159736303404412023035108541823040620220",
                "202232052877875883265662787535812502104",
                "132680628970572153755659300662247225545",
                "54439000496560275531324847576710945411",
                "327472636990873942890846779414449516221",
                "270767381785890644054342736219104341855",
                "53746657345169581590196573875532461541",
                "171751157592364337464737025613636320904",
                "264929111237516790495588483224463986137",
                "85610258641192726570090214757701622307",
                "21411412756490803471426712893807485152",
                "127019013591038711847920159585656505841",
                "104425769447540581213319890243365749787",
                "49365767676380782606007057787435842409",
                "313265995893062256506610256153823810480",
                "87667061478847161714016169056536777485",
                "71817624476825156275475583746056808690",
                "25514228701469280208334731640247609270",
                "96450889907448135617223285327976548385",
                "276787073013959177168346415651953195428",
                "79255188978032416024989157140725567319",
                "63903205278542990705870396237024170171",
                "123212092088881229351241467317515923450",
                "113519485916674162638541301274395896160",
                "336505081153996091477894612734988000348",
                "87743713581520543084939984132894148297",
                "274763779621639484432542522643600384152",
                "335871313205894390349967459652500975586",
                "237974416474578520230610977542795898572",
                "140690737425097890069425651161412433167",
                "165947892600636435914183282630370239365",
                "190150565545022397930411841096699957118",
                "113235817900284902766656622053656485562",
                "44259814072760552849698984126306493031",
                "218254719476850738270782966122037265554",
                "11809969507793336285784714789020374484",
                "218482548752652933873704407133357273617",
                "68888444401962736375737863459847188135",
                "7005361021304112142403737493528209979",
                "34890465642248467724758572712117777535",
                "156234666723899638240491883573422839910",
                "3824761359310122688705131241748969749",
                "174211772268428694952246341209943039442",
                "241258535973443679959403989587816931458",
                "277272457969566279720734971750034682946",
                "223081928972452396777278494386521738592",
                "319720832804335705066899468862116100391",
                "303828890539962469506983399220593935754",
                "166955210251033722740460856330520469514",
                "231336690152405853149469217323051010946",
                "254670767356556492479095493499090850422",
                "46096527227614140100588556169003097101",
                "293132701773131525674621312515868559909",
                "287283708725259801421913662001723000870",
                "136977195691502005557464572481169288913",
                "70450891745507078414257105606658975979",
                "152196303631745846337244928514511987593",
                "161206520692148108079447109275709826250",
                "151060714194122843894506245182624333142",
                "28082693690734393619413309089616032307",
                "111815592282070624136136741629609759996",
                "49571444992492886689617146445736191982",
                "333088017141556884319358105224613879958",
                "230810444416416295260822293168973921747",
                "287828976752432874474946720404097422835",
                "15215001067695801038856549839505821844",
                "209485273953473932136722151709372717481",
                "109894579197766863668520844349946877261",
                "103752353330791920315325682227485817099",
                "208116196741830523011126503923170454084",
                "321454141386454262999228148072804276367"
            ]
        },
        "source": "https://github.com/xwiki/xwiki-platform/commit/bca72f5ce971a31dba2a016d8dd8badda4475206",
        "signature_type": "Line"
    }
]