CVE-2025-54125: XWiki Platform Information Disclosure Flaw

CVE-2025-54125 Overview

CVE-2025-54125 is an information disclosure vulnerability in XWiki Platform Legacy Old Core and XWiki Platform Old Core. The XML export functionality, triggered by appending ?xpage=xml to any page URL, exposes password and email properties stored on documents when those properties are not literally named password or email. Any authenticated user with view rights on the affected page can trigger the export and retrieve the sensitive fields. The flaw is tracked under [CWE-359: Exposure of Private Personal Information to an Unauthorized Actor].

Critical Impact
Users with only view permissions can extract stored credentials and email addresses from XWiki documents by requesting the XML export endpoint.

Affected Products

XWiki Platform Legacy Old Core and Old Core, versions 1.1 through 16.4.6
XWiki Platform versions 16.5.0-rc-1 through 16.10.4
XWiki Platform versions 17.0.0-rc-1 through 17.1.0

Discovery Timeline

2025-08-06 - CVE-2025-54125 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-54125

Vulnerability Analysis

XWiki documents can store structured objects containing typed properties. Two of these property types, Password and Email, hold sensitive values. The platform's XML serialization path did not consistently identify these properties by type. Instead, it filtered fields by name, so any property of type Password or Email with a custom field name was serialized in plaintext (or in its stored form) inside the XML output. An attacker with view rights can request the XML representation of a document and receive the sensitive values that the application UI would normally mask or omit.

Root Cause

The root cause is missing type-based filtering in the document export logic. The XML view template templates/xml.vm and the underlying DocumentInstanceInputProperties filter relied on hardcoded property name checks rather than inspecting the property class. The security fix introduces proper APIs to filter sensitive fields from exports, tracked as issue XWIKI-22810.

Attack Vector

Exploitation requires only network access to the XWiki instance and view rights on a target page containing sensitive object properties. The attacker sends a single HTTP GET request such as GET /xwiki/bin/view/Space/Page?xpage=xml and parses the response for <property> elements corresponding to password or email fields.

java

// Security patch excerpt: DocumentInstanceInputProperties.java
// XWIKI-22810: Introduce and use proper APIs to filter sensitive fields from export
import org.xwiki.properties.annotation.PropertyDescription;
import org.xwiki.properties.annotation.PropertyName;
import org.xwiki.stability.Unstable;

/**
 * @version $Id$
 */

java

// Security patch excerpt: com/xpn/xwiki/api/Document.java
// Adds StringWriter and Set imports used by the new filtering APIs
import java.io.IOException;
import java.io.InputStream;
import java.io.StringWriter;
import java.util.ArrayList;
import java.util.Collections;
import java.util.Date;
import java.util.HashMap;
import java.util.List;
import java.util.Locale;
import java.util.Map;
import java.util.Set;
import java.util.Vector;

import org.apache.commons.fileupload.FileItem;

Source: XWiki security patch commit 742ee34

Detection Methods for CVE-2025-54125

Indicators of Compromise

HTTP GET requests to XWiki URLs containing the query parameter xpage=xml, especially from low-privilege accounts.
Repeated XML export requests against multiple document paths within a short window, indicating enumeration.
Access log entries showing 200 responses to ?xpage=xml requests followed by outbound data flows disproportionate to a normal page view.

Detection Strategies

Parse XWiki access logs for requests where the query string contains xpage=xml and correlate with user roles to flag view-only accounts issuing the request.
Deploy a web application firewall rule that inspects responses from the xpage=xml endpoint for <property> elements matching password or email class names and alerts on hits.
Baseline the volume of XML export requests per user and alert on deviations.

Monitoring Recommendations

Forward XWiki servlet container access logs and application logs to a central analytics platform for query and retention.
Track HTTP status, request URI, query string, and authenticated user identity on every XWiki request.
Monitor the affected XWiki hosts for outbound transfers of large XML payloads to unusual destinations.

How to Mitigate CVE-2025-54125

Immediate Actions Required

Upgrade XWiki Platform to version 16.4.7, 16.10.5, or 17.2.0-rc-1 or later, matching your current release train.
Rotate credentials stored in XWiki Password fields that may have been exposed prior to patching.
Audit view rights on documents containing user objects, LDAP configuration, or integration credentials.

Patch Information

The fix is delivered in XWiki Platform versions 16.4.7, 16.10.5, and 17.2.0-rc-1. Review the XWiki Security Advisory GHSA-57q2-6cp4-9mq3, the upstream commit 742ee34, and the XWiki Jira issue XWIKI-22810 for full technical details.

Workarounds

If patching is not immediately possible, delete templates/xml.vm from the deployed WAR. No built-in XWiki feature depends on the XML export.
Restrict view rights on documents that store password or email properties to trusted roles only until the upgrade is applied.
Block requests containing xpage=xml at a reverse proxy or WAF for anonymous and low-privilege sessions.

bash

# Remove the vulnerable template from the deployed WAR (workaround)
cd $TOMCAT_HOME/webapps/xwiki/templates
rm -f xml.vm
# Restart the servlet container to reload the webapp
systemctl restart tomcat