CVE-2025-29925: XWiki Platform Information Disclosure Flaw

CVE-2025-29925 Overview

CVE-2025-29925 is an information disclosure vulnerability in XWiki Platform, an open-source generic wiki platform. The flaw resides in the /rest/wikis/[wikiName]/pages REST endpoint. Prior to versions 15.10.14, 16.4.6, and 16.10.0-rc-1, the endpoint returned lists of protected pages without enforcing view rights. Unauthenticated attackers can enumerate page titles even when the wiki is configured with "Prevent unregistered user to view pages". The vulnerability is mapped to [CWE-402] (Transmission of Private Resources into a New Sphere). XWiki maintainers patched the issue by filtering endpoint results against page-level permissions.

Critical Impact
Unauthenticated network attackers can enumerate protected page names from XWiki instances through the REST API, bypassing view-right restrictions on the main wiki.

Affected Products

XWiki Platform versions prior to 15.10.14
XWiki Platform 16.x versions prior to 16.4.6
XWiki Platform 16.10.0 versions prior to 16.10.0-rc-1

Discovery Timeline

2025-03-19 - CVE-2025-29925 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-29925

Vulnerability Analysis

The vulnerability affects the WikiPagesResourceImpl REST resource in xwiki-platform-rest-server. When a client requests /rest/wikis/[wikiName]/pages, the server returned the full page list before applying view-right authorization checks per page. The pre-patch code performed a coarse-grained authorization check against the wiki reference only, which failed for path-based multi-wiki setups where the endpoint always queried the main wiki instead of the target wiki. As a result, unauthenticated users could retrieve page names from wikis marked with "Prevent unregistered user to view pages". The endpoint exposes structural metadata about protected wiki content without granting page body access, but the disclosed page names, hierarchies, and references still leak sensitive intelligence useful for reconnaissance.

Root Cause

The root cause is missing per-item authorization at the REST layer. The controller relied on a single wiki-level hasAccess(Right.VIEW, ...) check, which was insufficient to enforce page-level permissions. Additionally, the wiki context resolution defaulted to the main wiki in path-based instances, so even the coarse check evaluated the wrong resource.

Attack Vector

The attack requires only network access to the XWiki REST API. No authentication, user interaction, or elevated privileges are required. An attacker sends an HTTP GET request to the vulnerable endpoint and parses the returned page list.

java

// Security patch from WikiPagesResourceImpl.java
// Source: https://github.com/xwiki/xwiki-platform/commit/1fb12d2780f37b34a1b4dfdf8457d97ce5cbb2df
        XWikiContext context = Utils.getXWikiContext(componentManager);
        WikiReference wikiReference = context.getWikiReference();
        context.setWikiReference(new WikiReference(wikiName));
-        if (!this.contextualAuthorizationManager.hasAccess(Right.VIEW, new WikiReference(wikiName))) {
-            throw new WebApplicationException(Response.Status.UNAUTHORIZED);
-        }

        Pages pages = objectFactory.createPages();
        try {

The patch removes the insufficient wiki-level check and replaces it with per-page filtering downstream, so results only include pages the requesting user is authorized to view. See the XWiki GitHub Security Advisory GHSA-22q5-9phm-744v for full context.

Detection Methods for CVE-2025-29925

Indicators of Compromise

Anonymous or unauthenticated HTTP GET requests to /rest/wikis/*/pages returning non-empty page lists.
High volumes of REST API requests enumerating multiple wikiName values from a single source IP.
Requests to /rest/wikis/xwiki/pages in instances configured with "Prevent unregistered user to view pages".

Detection Strategies

Review XWiki access logs for requests matching the pattern /rest/wikis/[^/]+/pages originating from unauthenticated sessions.
Correlate REST endpoint hits with wiki security configuration flags to identify policy bypass events.
Alert when protected-wiki page enumeration responses precede authentication or credential-guessing activity.

Monitoring Recommendations

Ingest reverse proxy and application logs from XWiki servers into a centralized logging platform for retention and query.
Baseline normal REST API traffic patterns and flag anomalous spikes against /rest/wikis/* paths.
Monitor the XWiki xwiki.cfg and permission settings for drift that could re-enable anonymous exposure.

How to Mitigate CVE-2025-29925

Immediate Actions Required

Upgrade XWiki Platform to version 15.10.14, 16.4.6, or 16.10.0-rc-1 or later immediately.
Restrict access to the /rest/ endpoints at the reverse proxy layer for untrusted networks until patching is complete.
Audit REST access logs for prior enumeration attempts against /rest/wikis/*/pages.

Patch Information

The vulnerability is fixed in XWiki 15.10.14, 16.4.6, and 16.10.0RC1. The fixes are applied in commits 1fb12d2780f37b34a1b4dfdf8457d97ce5cbb2df and bca72f5ce971a31dba2a016d8dd8badda4475206. Tracking issues are recorded in XWIKI-22630 and XWIKI-22639. Post-patch, the endpoint continues to respond but filters results based on the requester's page-level rights.

Workarounds

Block or rate-limit anonymous requests to /rest/wikis/*/pages at the web server or WAF layer.
Require authentication for all /rest/ API paths via reverse proxy rules until the patch is applied.
Disable unauthenticated wiki access entirely if information disclosure risk outweighs public access requirements.

bash

# Nginx configuration example to require authentication on REST endpoints
location ~ ^/rest/wikis/[^/]+/pages {
    auth_request /auth-check;
    proxy_pass http://xwiki_backend;
}