CVE-2025-46554

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2025-46554

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-46554.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2025-46554

Aliases

GHSA-r5cr-xm48-97xp

Published

2025-04-30T18:27:53.677Z

Modified

2026-07-22T04:02:01.777856Z

Severity

5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS Calculator

Summary

XWiki missing authorization when accessing the wiki level attachments list and metadata via REST API

Details

XWiki is a generic wiki platform. In versions starting from 1.8.1 to before 14.10.22, from 15.0-rc-1 to before 15.10.12, from 16.0.0-rc-1 to before 16.4.3, and from 16.5.0-rc-1 to before 16.7.0, anyone can access the metadata of any attachment in the wiki using the wiki attachment REST endpoint. There is no filtering for the results depending on current user rights, meaning an unauthenticated user could exploit this even in a private wiki. This issue has been patched in versions 14.10.22, 15.10.12, 16.4.3, and 16.7.0.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/46xxx/CVE-2025-46554.json",
    "cna_assigner": "GitHub_M",
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "introduced": "1.8.1"
                },
                {
                    "fixed": "14.10.22"
                }
            ]
        }
    ],
    "cwe_ids": [
        "CWE-862"
    ]
}

References

Affected packages

Git / github.com/xwiki/xwiki-commons

Affected ranges

Type

GIT

Repo

https://github.com/xwiki/xwiki-commons

Events

Introduced

fdba4ca1398766e912f7888af5bdefbeef60d8b0

Fixed

a75114d3e9875bc3383329fa44f9b47bf2871762

Introduced

918ea43fe0d277c28efa21a871175b329c75157c

Fixed

a74a28b426e394510b9cebcf261fc91853719acf

Introduced

526fcc68b3f75862a2af7395b5a6dfdd3d2166a5

Fixed

5d810c17daacfef0a76e0800354511dbdf871b5b

Database specific

{
    "cpe": "cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*",
    "source": "CPE_RANGE",
    "extracted_events": [
        {
            "introduced": "15.0"
        },
        {
            "fixed": "15.10.12"
        },
        {
            "introduced": "16.0.0"
        },
        {
            "fixed": "16.4.3"
        },
        {
            "introduced": "16.5.0"
        },
        {
            "fixed": "16.7.0"
        }
    ]
}

Type

GIT

Repo

https://github.com/xwiki/xwiki-platform

Events

Introduced

96b4a230ee41ef74268c9720722f6473c705583d

Fixed

6914819340c6e94b51b7e5c68613f47831d4996b

Introduced

3c6f5cf138d8095f63631e554ba448e4b780e162

Fixed

82ba90784232fd5947c70b74bbbcfc67a245aca1

Introduced

177e524c2e218fe5de776619271b7cd12c929488

Fixed

a1474519e8b8025cd704b608450b7622d3163681

Fixed

37ecea84fdd053c33733c2ae9a0778bf98eae608

Fixed

a43e933ddeda17dad1772396e1757998260e9342

Fixed

c02ce7843a39851865b9d7b6132e32fdd21e3856

Database specific

{
    "cpe": "cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*",
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "15.0"
        },
        {
            "fixed": "15.10.12"
        },
        {
            "introduced": "16.0.0"
        },
        {
            "fixed": "16.4.3"
        },
        {
            "introduced": "16.5.0"
        },
        {
            "fixed": "16.7.0"
        }
    ]
}

Database specific

vanir_signatures

[
    {
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "271222280416443639707668829031231752956",
                "61178804486309906258473007893077723643",
                "77150776739467516363537270204444228502",
                "126032220484950708142107665585725028980",
                "228363429857992000420625550875559748249",
                "338379560377087766538870422344380427840",
                "232588093424152413363187323460008413291",
                "296198533569423769198696606162456576768",
                "167161990792139934819487265237074797442"
            ]
        },
        "signature_version": "v1",
        "source": "https://github.com/xwiki/xwiki-platform/commit/a43e933ddeda17dad1772396e1757998260e9342",
        "signature_type": "Line",
        "target": {
            "file": "xwiki-platform-core/xwiki-platform-rest/xwiki-platform-rest-server/src/main/java/org/xwiki/rest/internal/resources/attachments/AttachmentsResourceImpl.java"
        },
        "id": "CVE-2025-46554-0efa21de",
        "deprecated": false
    },
    {
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "279996040616240033048317151141465971223",
                "63480981983410327254449103487202754734",
                "166055876944648832198567989294601159874",
                "87656207174105165386304959920291028867",
                "45416947498930657728133433363743110947",
                "159998568406179035743791290832946874559",
                "132762063020150089644316896472829724597"
            ]
        },
        "signature_version": "v1",
        "source": "https://github.com/xwiki/xwiki-platform/commit/37ecea84fdd053c33733c2ae9a0778bf98eae608",
        "signature_type": "Line",
        "target": {
            "file": "xwiki-component/xwiki-component-default/src/main/java/org/xwiki/component/annotation/ComponentAnnotationLoader.java"
        },
        "id": "CVE-2025-46554-22161cf3",
        "deprecated": false
    },
    {
        "digest": {
            "length": 413.0,
            "function_hash": "319696321991483902318616819146081450572"
        },
        "signature_version": "v1",
        "source": "https://github.com/xwiki/xwiki-platform/commit/37ecea84fdd053c33733c2ae9a0778bf98eae608",
        "signature_type": "Function",
        "target": {
            "function": "testOverrides",
            "file": "xwiki-component/xwiki-component-default/src/test/java/org/xwiki/component/annotation/ComponentAnnotationLoaderTest.java"
        },
        "id": "CVE-2025-46554-3a790a3a",
        "deprecated": false
    },
    {
        "digest": {
            "length": 1232.0,
            "function_hash": "216674627221306195116507210413665903076"
        },
        "signature_version": "v1",
        "source": "https://github.com/xwiki/xwiki-platform/commit/a43e933ddeda17dad1772396e1757998260e9342",
        "signature_type": "Function",
        "target": {
            "function": "getAttachments",
            "file": "xwiki-platform-core/xwiki-platform-rest/xwiki-platform-rest-server/src/test/java/org/xwiki/rest/internal/resources/wikis/WikiAttachmentsResourceImplTest.java"
        },
        "id": "CVE-2025-46554-3ee11a32",
        "deprecated": false
    },
    {
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "128205215619784860505560691424437765780",
                "271741216023154103002269632854600722104",
                "162548602528504758531447331614570805836",
                "197218026322200313575553415460660788626",
                "186757299259157404853682316805834370471",
                "165145067342537025086321957444537830464",
                "123935610610063406442136485949390161547",
                "117583145691801919306651511256326376829",
                "183679129417912594594289276401743356521",
                "86041180853477372696256875334665686140",
                "235297795083225495673665298306177905584",
                "24347539411103939997957456250745781424",
                "308423107115460905053613977459743676507",
                "164389528709554626293076615703270602763",
                "168248489421915805594496202166096023906",
                "89317866248956902800168880311614021665",
                "56157148839807800314732327216694542406",
                "330175521504403839845732642149455164141",
                "167488609235483604821015000173629729209",
                "107959762650684564353131625456110941097",
                "134024940835162562703822610118800631776",
                "91427761260587130281466413620584076574",
                "27618400638679057293159673082362615391",
                "188019433314750527482210697050165663285",
                "322586979025409756350145840017184253073"
            ]
        },
        "signature_version": "v1",
        "source": "https://github.com/xwiki/xwiki-platform/commit/a43e933ddeda17dad1772396e1757998260e9342",
        "signature_type": "Line",
        "target": {
            "file": "xwiki-platform-core/xwiki-platform-rest/xwiki-platform-rest-server/src/test/java/org/xwiki/rest/internal/resources/wikis/WikiAttachmentsResourceImplTest.java"
        },
        "id": "CVE-2025-46554-74fa4440",
        "deprecated": false
    },
    {
        "digest": {
            "length": 1306.0,
            "function_hash": "183578898659158258578296343237849803053"
        },
        "signature_version": "v1",
        "source": "https://github.com/xwiki/xwiki-platform/commit/37ecea84fdd053c33733c2ae9a0778bf98eae608",
        "signature_type": "Function",
        "target": {
            "function": "initialize",
            "file": "xwiki-component/xwiki-component-default/src/main/java/org/xwiki/component/annotation/ComponentAnnotationLoader.java"
        },
        "id": "CVE-2025-46554-7f2bc2e0",
        "deprecated": false
    },
    {
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "275794024517038829705789551347538059566",
                "175876832033980944337461512203939835640",
                "168004375500754996568073926983319223599",
                "45781406895496274663423848633208041154",
                "139176414676959590359021428953305333808",
                "142084367809119525753970024321086975390",
                "51898526852151804988048547982650094763",
                "267697658058996804131701297376161218570",
                "146897789261645302920839404294163792055",
                "287207050997830097556134094090086869865",
                "203451007883144443479166785981936973049",
                "251576806825770229586745831254931416924",
                "201664644220110125726952835219317589209",
                "158214382401177012207219268387428845708",
                "236125877835400970788422979525739693335",
                "286242273149649746956285818653493748434",
                "170681510944300520959309914191857287727",
                "199820853727308801520342061160398569180",
                "148855176950170097471560583165298352149",
                "88752396961543268032848084009909827939",
                "214044021845286392479172932505778297847",
                "320515353316990079236365405002964617993",
                "159606592319555721181921845752561337075"
            ]
        },
        "signature_version": "v1",
        "source": "https://github.com/xwiki/xwiki-platform/commit/37ecea84fdd053c33733c2ae9a0778bf98eae608",
        "signature_type": "Line",
        "target": {
            "file": "xwiki-component/xwiki-component-default/src/test/java/org/xwiki/component/annotation/ComponentAnnotationLoaderTest.java"
        },
        "id": "CVE-2025-46554-81e9c9a0",
        "deprecated": false
    },
    {
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "116785895770272363928071737321160661658",
                "271741216023154103002269632854600722104",
                "162548602528504758531447331614570805836",
                "197218026322200313575553415460660788626",
                "186757299259157404853682316805834370471",
                "165145067342537025086321957444537830464",
                "123935610610063406442136485949390161547",
                "117583145691801919306651511256326376829",
                "183679129417912594594289276401743356521",
                "86041180853477372696256875334665686140",
                "235297795083225495673665298306177905584",
                "36861737178475016763398171648701409445",
                "14628639534752756430778083138393654183",
                "210367419178954808314354720393312789928",
                "260330886042332156134433345863130992892",
                "126049538792345203962136733648017090769",
                "88192353346399270015931216033999983609",
                "175283553048098470200867529228441699568",
                "126059191966402654375872407916916100009",
                "59930521351203858355793940826436480830",
                "17748756091443201396991792812319305381",
                "323586411114149347460003516809979524151"
            ]
        },
        "signature_version": "v1",
        "source": "https://github.com/xwiki/xwiki-platform/commit/a43e933ddeda17dad1772396e1757998260e9342",
        "signature_type": "Line",
        "target": {
            "file": "xwiki-platform-core/xwiki-platform-rest/xwiki-platform-rest-server/src/test/java/org/xwiki/rest/internal/resources/spaces/SpaceAttachmentsResourceImplTest.java"
        },
        "id": "CVE-2025-46554-89a84f6f",
        "deprecated": false
    },
    {
        "digest": {
            "length": 2785.0,
            "function_hash": "57958456193298884536574957882212212435"
        },
        "signature_version": "v1",
        "source": "https://github.com/xwiki/xwiki-platform/commit/a43e933ddeda17dad1772396e1757998260e9342",
        "signature_type": "Function",
        "target": {
            "function": "getAttachments",
            "file": "xwiki-platform-core/xwiki-platform-rest/xwiki-platform-rest-server/src/test/java/org/xwiki/rest/internal/resources/attachments/AttachmentsResourceImplTest.java"
        },
        "id": "CVE-2025-46554-956b15a2",
        "deprecated": false
    },
    {
        "digest": {
            "length": 775.0,
            "function_hash": "110873381031474286360359495154164791765"
        },
        "signature_version": "v1",
        "source": "https://github.com/xwiki/xwiki-platform/commit/a43e933ddeda17dad1772396e1757998260e9342",
        "signature_type": "Function",
        "target": {
            "function": "getAttachments",
            "file": "xwiki-platform-core/xwiki-platform-rest/xwiki-platform-rest-server/src/main/java/org/xwiki/rest/internal/resources/BaseAttachmentsResource.java"
        },
        "id": "CVE-2025-46554-b09c3f7e",
        "deprecated": false
    },
    {
        "digest": {
            "length": 1581.0,
            "function_hash": "307567537950774499836495885326742471697"
        },
        "signature_version": "v1",
        "source": "https://github.com/xwiki/xwiki-platform/commit/a43e933ddeda17dad1772396e1757998260e9342",
        "signature_type": "Function",
        "target": {
            "function": "getAttachments",
            "file": "xwiki-platform-core/xwiki-platform-rest/xwiki-platform-rest-server/src/test/java/org/xwiki/rest/internal/resources/spaces/SpaceAttachmentsResourceImplTest.java"
        },
        "id": "CVE-2025-46554-b5b5895b",
        "deprecated": false
    },
    {
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "195184728712371664461645896299954920934",
                "26790394271792461371986976206492149396",
                "81526336630242233591524187673745370189",
                "306963085561788174236384641322453170381",
                "141067982956242643007466272494666179699",
                "37660634045536912599245183053089090136",
                "118715208415318792984432893466692198380",
                "116480386319490006484222441472471438539",
                "170592176290067629884345420543075793289",
                "76631614782281521438011941569101017390",
                "320584110042960148567637894564380108103",
                "233986837467776479199271190850894506883",
                "77381718531202508064439099257348711420",
                "139300747868159909113862462798843602297",
                "179770613839328921308421448627958168354"
            ]
        },
        "signature_version": "v1",
        "source": "https://github.com/xwiki/xwiki-platform/commit/a43e933ddeda17dad1772396e1757998260e9342",
        "signature_type": "Line",
        "target": {
            "file": "xwiki-platform-core/xwiki-platform-rest/xwiki-platform-rest-server/src/main/java/org/xwiki/rest/internal/resources/BaseAttachmentsResource.java"
        },
        "id": "CVE-2025-46554-c97fa019",
        "deprecated": false
    },
    {
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "36425152367187051709974525168248298187",
                "185419423785149483892030680589266430487",
                "81908068330526711045808743465451289466",
                "35725773776387057498809422790005460197",
                "310399331766624307343648324191142742607",
                "198479907770745784675725998248917924887",
                "118168330383144229069337538005396547076",
                "126032220484950708142107665585725028980",
                "233716586249115245792409958528619977047",
                "21058331190837545321246285367596331724",
                "163418652674431847886761772411800306323",
                "88066193804674087426674459866253137320",
                "287350637249987823307621672093881178542"
            ]
        },
        "signature_version": "v1",
        "source": "https://github.com/xwiki/xwiki-platform/commit/c02ce7843a39851865b9d7b6132e32fdd21e3856",
        "signature_type": "Line",
        "target": {
            "file": "xwiki-platform-core/xwiki-platform-rest/xwiki-platform-rest-server/src/main/java/org/xwiki/rest/internal/resources/attachments/AttachmentResourceImpl.java"
        },
        "id": "CVE-2025-46554-d5a1fde9",
        "deprecated": false
    },
    {
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "46509132122533989748297202936830653369",
                "18452432426670668392516702883929473406",
                "220042716535807628812056779947794159590",
                "202424379988976590044393222337636381705",
                "192604175022975940290033964590013258085",
                "237166684711007054117645033364324452283",
                "262005687037975851033151544393172976295"
            ]
        },
        "signature_version": "v1",
        "source": "https://github.com/xwiki/xwiki-platform/commit/a43e933ddeda17dad1772396e1757998260e9342",
        "signature_type": "Line",
        "target": {
            "file": "xwiki-platform-core/xwiki-platform-rest/xwiki-platform-rest-server/src/test/java/org/xwiki/rest/internal/resources/attachments/AttachmentsResourceImplTest.java"
        },
        "id": "CVE-2025-46554-ebb4ca17",
        "deprecated": false
    }
]

vanir_signatures_modified

"2026-07-22T04:02:01Z"

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-46554.json"