CVE-2025-46554: XWiki Information Disclosure Vulnerability

CVE-2025-46554 Overview

CVE-2025-46554 is a missing authorization vulnerability [CWE-862] in the XWiki generic wiki platform. The wiki attachment REST endpoint returns attachment metadata without filtering results against the current user's rights. An unauthenticated attacker can query the endpoint and enumerate attachment metadata from any wiki, including private wikis. The flaw affects XWiki versions from 1.8.1 up to 14.10.22, 15.0-rc-1 up to 15.10.12, 16.0.0-rc-1 up to 16.4.3, and 16.5.0-rc-1 up to 16.7.0. Fixed releases are 14.10.22, 15.10.12, 16.4.3, and 16.7.0.

Critical Impact
Unauthenticated remote attackers can enumerate attachment metadata across public and private XWiki instances, exposing filenames, sizes, authors, and revision data that should require authentication and read rights.

Affected Products

XWiki Platform versions 1.8.1 through 14.10.21
XWiki Platform versions 15.0-rc-1 through 15.10.11
XWiki Platform versions 16.0.0-rc-1 through 16.4.2 and 16.5.0-rc-1 through 16.6.x

Discovery Timeline

2025-04-30 - CVE-2025-46554 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-46554

Vulnerability Analysis

The vulnerability resides in the XWiki REST server module, specifically in BaseAttachmentsResource.java and related attachment resource implementations under xwiki-platform-rest-server. The endpoint enumerated wiki attachments and returned metadata objects without invoking an authorization check against the requesting user. Because REST endpoints in XWiki are reachable by anonymous callers by default, an attacker with no account can send a single HTTP request and receive attachment metadata for documents that would otherwise be gated by view rights.

The exposed metadata includes attachment names, MIME types, sizes, authors, and version history. This data class is a confidentiality-only exposure, but on private wikis it defeats the access control model and can reveal document structure, internal filenames, and authorship of restricted content useful for follow-on attacks.

Root Cause

The root cause is a missing authorization check [CWE-862] in the attachment REST resources. The resource collected attachment references from the underlying store and serialized them to the response without asking the ContextualAuthorizationManager whether the current user held Right.VIEW on the parent document.

Attack Vector

Exploitation requires only network access to the XWiki REST API. No authentication, user interaction, or elevated privileges are required. An attacker issues a GET request against the wiki attachments REST endpoint and receives JSON or XML metadata for attachments the account should not be able to see.

java

// Patch: introduce ContextualAuthorizationManager into BaseAttachmentsResource
 import org.xwiki.rest.internal.Utils;
 import org.xwiki.rest.model.jaxb.Attachment;
 import org.xwiki.rest.model.jaxb.Attachments;
+import org.xwiki.security.authorization.ContextualAuthorizationManager;
+import org.xwiki.security.authorization.Right;
 import org.xwiki.user.UserReferenceResolver;

 import com.xpn.xwiki.XWiki;
// Source: https://github.com/xwiki/xwiki-platform/commit/a43e933ddeda17dad1772396e1757998260e9342

The fix wires ContextualAuthorizationManager into the base resource so each attachment reference is filtered against Right.VIEW before being added to the response set. Corresponding changes in AttachmentsResourceImpl.java and AttachmentResourceImpl.java remove now-redundant imports and route authorization through the shared helper.

Detection Methods for CVE-2025-46554

Indicators of Compromise

Unauthenticated HTTP GET requests to REST paths matching /rest/wikis/*/spaces/*/pages/*/attachments or /rest/wikis/*/attachments originating from a single source IP
High-volume enumeration patterns against the attachments REST API with no prior authentication events for the same session
User-Agent strings associated with scripted HTTP clients (curl, python-requests, go-http-client) hitting attachment endpoints in bulk

Detection Strategies

Review XWiki access logs for 2xx responses to attachment REST endpoints where the session cookie or Authorization header is absent
Correlate reverse-proxy logs for repeated requests iterating over space or page identifiers under /rest/
Alert on anonymous REST traffic to /rest/wikis/xwiki/**/attachments that exceeds a low baseline threshold

Monitoring Recommendations

Enable request logging with query strings and response sizes on the fronting web server or reverse proxy
Forward XWiki application and access logs to a centralized log platform and retain them long enough to detect slow enumeration
Track the ratio of anonymous to authenticated REST calls per endpoint and investigate deviations from historical norms

How to Mitigate CVE-2025-46554

Immediate Actions Required

Upgrade XWiki to 14.10.22, 15.10.12, 16.4.3, or 16.7.0 depending on your release branch
Inventory public-facing XWiki instances and confirm the running version against the fixed releases
Review web server access logs for prior unauthenticated hits against attachment REST endpoints to gauge exposure

Patch Information

The issue is tracked as XWIKI-22424 and disclosed in GitHub Security Advisory GHSA-r5cr-xm48-97xp. The authorization fix is implemented across commits a43e933d, c02ce784, and 37ecea84.

Workarounds

Restrict anonymous access to /rest/ paths at the reverse proxy until the upgrade is deployed
Require authentication for all HTTP requests to the wiki using a front-end web server rule
Deploy the patched files from the referenced commits manually if a full version upgrade is not immediately feasible

bash

# Example nginx rule: require authentication for XWiki REST attachment endpoints
location ~* ^/xwiki/rest/.*/attachments {
    auth_request /auth;
    proxy_pass http://xwiki_backend;
}