CVE-2025-29926

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-29926
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-29926.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-29926
Aliases
Published
2025-03-19T17:40:44.937Z
Modified
2026-04-10T05:24:37.494401Z
Severity
  • 7.9 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:H/SI:H/SA:H CVSS Calculator
Summary
The WikiManager REST API allows any user to create wikis
Details

XWiki Platform is a generic wiki platform. Prior to 15.10.15, 16.4.6, and 16.10.0, any user can exploit the WikiManager REST API to create a new wiki, where the user could become an administrator and so performs other attacks on the farm. Note that this REST API is not bundled in XWiki Standard by default: it needs to be installed manually through the extension manager. The problem has been patched in versions 15.10.15, 16.4.6 and 16.10.0 of the REST module.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/29xxx/CVE-2025-29926.json",
    "cwe_ids": [
        "CWE-285"
    ]
}
References

Affected packages

Git / github.com/xwiki/xwiki-platform

Affected ranges

Type
GIT
Repo
https://github.com/xwiki/xwiki-platform
Events
Introduced
4e0cda1749b9c44a62ae8e89fc5ad13c88cf587e
Fixed
72fc19ec15b50001cc0b6a9987e344d85f5c56cd
Database specific 
{
    "versions": [
        {
            "introduced": "5.4-rc-1"
        },
        {
            "fixed": "15.10.15"
        }
    ]
}
Type
GIT
Repo
https://github.com/xwiki/xwiki-platform
Events
Introduced
6f103dbca9c98cf3b53bfadb83d982facb198d56
Fixed
5292357f68df062a1b2f6a48410c3753e94771d3
Database specific 
{
    "versions": [
        {
            "introduced": "16.0.0-rc-1"
        },
        {
            "fixed": "16.4.6"
        }
    ]
}
Type
GIT
Repo
https://github.com/xwiki/xwiki-platform
Events
Introduced
ed06c998964cae931ccfe7005a67eeaedaf60e58
Fixed
d6d65b31d1a464df7e0d5d1b7491f926d45c155e
Database specific 
{
    "versions": [
        {
            "introduced": "16.5.0-rc-1"
        },
        {
            "fixed": "16.10.0"
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-29926.json"