CVE-2025-54125
- Source
- https://cve.org/CVERecord?id=CVE-2025-54125
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-54125.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2025-54125
- Aliases
- Published
- 2025-08-05T23:30:38.963Z
- Modified
- 2026-07-22T04:02:19.349094Z
- Severity
-
- 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- XWiki Platform: Password and email exposure in xml.vm fields
- Details
-
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. XWiki Platform Legacy Old Core and XWiki Platform Old Core versions 1.1 through 16.4.6, 16.5.0-rc-1 through 16.10.4 and 17.0.0-rc-1 through 17.1.0, the XML export of a page in XWiki that can be triggered by any user with view rights on a page by appending ?xpage=xml to the URL includes password and email properties stored on a document that aren't named password or email. This is fixed in versions 16.4.7, 16.10.5 and 17.2.0-rc-1. To work around this issue, the file templates/xml.vm in the deployed WAR can be deleted if the XML isn't needed. There isn't any feature in XWiki itself that depends on the XML export.
- Database specific
{ "cwe_ids": [ "CWE-359" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/54xxx/CVE-2025-54125.json", "cna_assigner": "GitHub_M" }- References
-
- https://jira.xwiki.org/browse/XWIKI-22810
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/54xxx/CVE-2025-54125.json
- https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-57q2-6cp4-9mq3
- https://nvd.nist.gov/vuln/detail/CVE-2025-54125
- https://github.com/xwiki/xwiki-platform/commit/742ee3482ef6c2bd4ad03d0de9cdd81d0e8f3d59
Affected packages
Git / github.com/xwiki/xwiki-commons
Affected ranges
- Type
- GIT
- Repo
- https://github.com/xwiki/xwiki-commons
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixedIntroducedFixedIntroducedLast affected
- Database specific
{ "cpe": "cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*", "source": "CPE_RANGE", "extracted_events": [ { "introduced": "1.1" }, { "fixed": "16.4.7" }, { "introduced": "16.5.0" }, { "fixed": "16.10.5" }, { "introduced": "17.0.0" }, { "last_affected": "17.1.0" } ] }
- Type
- GIT
- Repo
- https://github.com/xwiki/xwiki-platform
- Events
- Database specific
{ "cpe": "cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*", "source": [ "CPE_RANGE", "REFERENCES" ], "extracted_events": [ { "introduced": "1.1" }, { "fixed": "16.4.7" }, { "introduced": "16.5.0" }, { "fixed": "16.10.5" }, { "introduced": "17.0.0" }, { "last_affected": "17.1.0" } ] }
Affected versions
xwiki-commons-16.*
xwiki-commons-16.10.0
xwiki-commons-16.10.0-rc-1
xwiki-commons-16.10.1
xwiki-commons-16.10.2
xwiki-commons-16.10.3
xwiki-commons-16.10.4
xwiki-commons-16.4.0
xwiki-commons-16.4.0-rc-1
xwiki-commons-16.4.1
xwiki-commons-16.4.2
xwiki-commons-16.4.3
xwiki-commons-16.4.4
xwiki-commons-16.4.5
xwiki-commons-16.4.6
xwiki-commons-17.*
xwiki-commons-17.1.0
xwiki-commons-17.1.0-rc-1
xwiki-commons-8.*
xwiki-commons-8.0-milestone-1
xwiki-commons-8.0-milestone-2
xwiki-commons-8.1-milestone-1
xwiki-commons-8.1-milestone-2
xwiki-commons-8.2-milestone-1
xwiki-commons-8.2-milestone-2
xwiki-commons-8.3-milestone-1
xwiki-commons-8.3-milestone-2
Database specific
vanir_signatures_modified
"2026-07-22T04:02:19Z"
vanir_signatures
[
{
"signature_type": "Line",
"target": {
"file": "xwiki-platform-core/xwiki-platform-filter/xwiki-platform-filter-instance/xwiki-platform-filter-instance-document/src/main/java/org/xwiki/filter/instance/input/DocumentInstanceInputProperties.java"
},
"deprecated": false,
"source": "https://github.com/xwiki/xwiki-platform/commit/742ee3482ef6c2bd4ad03d0de9cdd81d0e8f3d59",
"id": "CVE-2025-54125-045b464b",
"signature_version": "v1",
"digest": {
"line_hashes": [
"116253179930766428168532364329171002083",
"37067409757970071408150387770668677173",
"320424597318912207514899867995036097807",
"180476897179326211153583594259258405432",
"236629517524165160830734471192479102333",
"117833685268915227386356212851990777614",
"114559724893280123107282731575396856989",
"288670380433486698357707786855784395655",
"147768348250042517025400936419634023832"
],
"threshold": 0.9
}
},
{
"signature_type": "Line",
"target": {
"file": "xwiki-platform-core/xwiki-platform-oldcore/src/test/java/com/xpn/xwiki/api/DocumentTest.java"
},
"deprecated": false,
"source": "https://github.com/xwiki/xwiki-platform/commit/742ee3482ef6c2bd4ad03d0de9cdd81d0e8f3d59",
"id": "CVE-2025-54125-154c5099",
"signature_version": "v1",
"digest": {
"line_hashes": [
"155669118106017797388400908082479689734",
"46254585693802268014036497520402201611",
"184714438376055698038092557143191817383",
"33618357771697693124189316837617291763",
"166815641366930650574446054740514951763",
"316805421556054033476153710377640676684",
"35055676695254260984157680006984443616",
"55240013232567305589954460732021724941",
"24747777008384280104720869225459190847",
"264167089711321986563326463579007473328",
"191862352189347295900610683684671704882",
"79455943387692111294722349360023656275",
"214542572755399786128629491400904800754",
"211574229766822386141147940292219519907",
"205614066251606376757109032552210734049",
"195173105427273202450024475037491131280",
"271396545371159661947241571546803016598",
"219411354906959569191938045603138235894",
"192150034851059571492011786920361509270",
"33205969579569921976235655594267144434",
"302394132893555846193095799076405002235",
"5252715175168381181687828680346999974",
"224441478446581339766905545885143033964",
"2735896028436035660741693237276734854",
"15723278979384777827470772190469782688",
"55419409582737039155793808167590550360",
"112328065489508876849977806400677449185",
"267437169814020682127885184330061657553",
"183106456713300939688133789013886969101",
"169047409875825879275769490999323614364",
"325291012678653101894957571024763309107"
],
"threshold": 0.9
}
},
{
"signature_type": "Function",
"target": {
"file": "xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/api/Document.java",
"function": "getXMLContent"
},
"deprecated": false,
"source": "https://github.com/xwiki/xwiki-platform/commit/742ee3482ef6c2bd4ad03d0de9cdd81d0e8f3d59",
"id": "CVE-2025-54125-63edbe43",
"signature_version": "v1",
"digest": {
"function_hash": "162592239907094141824549764744330838541",
"length": 322.0
}
},
{
"signature_type": "Function",
"target": {
"file": "xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/internal/filter/input/BaseObjectEventGenerator.java",
"function": "write"
},
"deprecated": false,
"source": "https://github.com/xwiki/xwiki-platform/commit/742ee3482ef6c2bd4ad03d0de9cdd81d0e8f3d59",
"id": "CVE-2025-54125-8424742f",
"signature_version": "v1",
"digest": {
"function_hash": "286671876569330565327368568639706491175",
"length": 1088.0
}
},
{
"signature_type": "Line",
"target": {
"file": "xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/internal/filter/input/BaseObjectEventGenerator.java"
},
"deprecated": false,
"source": "https://github.com/xwiki/xwiki-platform/commit/742ee3482ef6c2bd4ad03d0de9cdd81d0e8f3d59",
"id": "CVE-2025-54125-882ec9b4",
"signature_version": "v1",
"digest": {
"line_hashes": [
"234063185789416628764586381169116809475",
"241021916290166697362033013261493252166",
"135762397532841550182433837694265932715",
"17585715316810359992099106544266890492",
"239615398312449186185509233388195247377",
"16010794411704522522006908445314188149",
"294698897867800128680400861299872185591",
"303767504789083647381035508440695378475",
"233515334653208196040686775235808561171",
"194704246257225414028102806800030405049",
"339816964738006942227791274546836589171"
],
"threshold": 0.9
}
},
{
"signature_type": "Line",
"target": {
"file": "xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/api/Document.java"
},
"deprecated": false,
"source": "https://github.com/xwiki/xwiki-platform/commit/742ee3482ef6c2bd4ad03d0de9cdd81d0e8f3d59",
"id": "CVE-2025-54125-b7b24f30",
"signature_version": "v1",
"digest": {
"line_hashes": [
"302872959928222412568992614144953497618",
"209130157030305553653246883855101211089",
"213721474446611684659845267679373063197",
"233082241354066570813448180093819670417",
"48992142150163792532016110092701502889",
"326951403612085448100830167304558728150",
"109399852841443390171931526583944911319",
"69458332352728482853115345921373684999",
"167821673527487270694454245053537512977",
"189904850424354021977446650871173225887",
"317197446589223762431330577006816295746",
"244883265243062335794769745605080295555",
"191380402075233854190656422475850059867",
"296589103551155653369861432336371919070",
"270212643768079890112253955547483629957",
"21141835682737743608092494001385486482",
"45734311595209084138009898852567064220",
"116532233828863163666500049793639368481"
],
"threshold": 0.9
}
}
]
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-54125.json"