CVE-2025-48885

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-48885
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-48885.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-48885
Aliases
  • GHSA-c57g-9v2r-w8v3
Published
2025-05-30T18:41:59.248Z
Modified
2026-04-02T12:50:29.614910Z
Severity
  • 5.7 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
application-urlshortener users can create arbitrary pages as long as they have view access to them
Details

application-urlshortener create shortened URLs for XWiki pages. Versions prior to 1.2.4 are vulnerable to users with view access being able to create arbitrary pages. Any user (even guests) can create these docs, even if they don't exist already. This can enable guest users to denature the structure of wiki pages, by creating 1000's of pages with random name, that then become very difficult to handle by admins. Version 1.2.4 fixes the issue. No known workarounds are available.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/48xxx/CVE-2025-48885.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-352"
    ]
}
References

Affected packages

Git / github.com/xwikisas/application-urlshortener

Affected ranges

Type
GIT
Repo
https://github.com/xwikisas/application-urlshortener
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
bdc4bb7453f7b776a08b92f56efe70bddec6bcce

Affected versions

application-urlshortener-1.*
application-urlshortener-1.0
application-urlshortener-1.1
application-urlshortener-1.1.1
application-urlshortener-1.2
application-urlshortener-1.2.1
application-urlshortener-1.2.2
application-urlshortener-1.2.3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-48885.json"