CVE-2025-48885: XWiki URL Shortener Auth Bypass Vulnerability

CVE-2025-48885 Overview

CVE-2025-48885 affects the application-urlshortener extension for XWiki, which creates shortened URLs for wiki pages. In versions prior to 1.2.4, the URL shortener endpoint fails to verify that a target document exists before creating a shortener object. Any authenticated user with view access, including guest users when guest access is enabled, can trigger creation of arbitrary pages by requesting shortened URLs for non-existent references. Attackers can programmatically generate thousands of junk pages with random names, degrading wiki integrity and forcing administrators into manual cleanup. The maintainers released version 1.2.4 to fix the issue, and no workarounds are available.

Critical Impact
Unauthenticated or low-privileged users can create arbitrary XWiki pages, enabling wiki content pollution and administrative denial of service through mass page creation.

Affected Products

xwikisas application-urlshortener versions prior to 1.2.4
XWiki instances with the URL Shortener application installed
XWiki deployments permitting guest or low-privileged view access

Discovery Timeline

2025-05-30 - CVE-2025-48885 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-48885

Vulnerability Analysis

The vulnerability resides in DefaultURLShortenerResource.java, the REST endpoint responsible for generating shortened URLs. The handler resolves a caller-supplied currentDocRef into a DocumentReference and then invokes addURLShortenerXObject on the resulting document. Because XWiki's document API lazily instantiates a page object when one does not exist, calling getDocument on an unknown reference returns a new, empty document. Saving the shortener XObject persists that document, effectively creating a new wiki page under an attacker-chosen name. The flaw is classified as [CWE-352] Cross-Site Request Forgery in the advisory, though the practical exploitation pattern is closer to broken access control combined with missing existence validation.

Root Cause

The endpoint checked Right.VIEW on the resolved reference but never verified that the referenced document actually existed before writing to it. View access to non-existent pages is implicitly granted, so any user could reach the write path and materialize new pages.

Attack Vector

An attacker with view rights, or a guest on wikis allowing guest access, sends repeated REST requests to the URL shortener endpoint using random or targeted currentDocRef values. Each request creates a new page, allowing rapid pollution of the wiki namespace and disruption of administrative workflows.

java

// Patch applied in DefaultURLShortenerResource.java
XWikiContext xcontext = xcontextProvider.get();
DocumentReference documentReference = documentReferenceResolver.resolve(currentDocRef);

if (!xcontext.getWiki().exists(documentReference, xcontext)) {
    return Response.status(Response.Status.NOT_FOUND).type(MediaType.APPLICATION_JSON).build();
}

if (authorization.hasAccess(Right.VIEW, documentReference)) {
    XWikiDocument currentDoc = xcontext.getWiki().getDocument(documentReference, xcontext);
    String pageID = addURLShortenerXObject(currentDoc);

Source: GitHub commit f121a9c. The fix returns HTTP 404 when the target document does not already exist, blocking the page-creation side effect.

A parallel change in URLShortener/Code/UI.xml adds an $xwiki.exists($doc) guard around the shortener UI macro so the button is hidden on non-existent pages.

Detection Methods for CVE-2025-48885

Indicators of Compromise

Sudden spikes in XWiki page counts, particularly pages with random or non-descriptive names
Repeated POST requests to the URL shortener REST endpoint from a single user or IP
New pages containing only a URLShortener.Code.URLShortenerClass XObject and no other content
Page authors attributed to XWiki.XWikiGuest or low-privilege accounts across many new documents

Detection Strategies

Query the XWiki database for pages created within short time windows and correlate against expected editorial activity
Inspect web server access logs for high-frequency requests to the /rest/urlshortener path
Alert on documents whose only attached XObject is URLShortenerClass, indicating programmatic creation

Monitoring Recommendations

Enable and forward XWiki access logs to a centralized logging platform for baseline comparison
Track the rate of new page creation per user account and trigger alerts on deviations from historical norms
Review guest access permissions and audit anonymous write activity across the wiki

How to Mitigate CVE-2025-48885

Immediate Actions Required

Upgrade application-urlshortener to version 1.2.4 or later on all XWiki instances
Audit existing wiki pages for mass-created junk documents and remove them
Restrict guest access where business requirements permit, reducing the exposure surface

Patch Information

The fix is delivered in application-urlshortener version 1.2.4 via commit f121a9c973fd25948e82efcb6289d53fe00a9e7d. See the GitHub Security Advisory GHSA-c57g-9v2r-w8v3 for full details.

Workarounds

No official workarounds are available per the vendor advisory
Temporarily uninstall the URL Shortener extension if immediate upgrade is not feasible
Revoke view rights for guest and untrusted user groups until the patched version is deployed

bash

# Verify installed extension version via the XWiki Extension Manager CLI
curl -u admin:password \
  "https://wiki.example.com/xwiki/rest/extensions/com.xwiki.urlshortener:application-urlshortener-ui"

# Expected: version >= 1.2.4