How severe is CVE-2025-29925?

CVE-2025-29925 has a CVSS 3.x base score of 5.3, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is low, integrity none, and availability none.

Is CVE-2025-29925 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (56th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2025-29925?

CVE-2025-29925 affects Xwiki. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2025-29925?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2025-29925 have an EU (EUVD) identifier?

Yes. CVE-2025-29925 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-6735.

When was CVE-2025-29925 published?

CVE-2025-29925 was published on 2025-03-19 and last updated on 2026-06-17.

CVE-2025-29925

CVE-2025-29925 is a medium-severity vulnerability in Xwiki with a CVSS 3.x base score of 5.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-402.

Key facts

Severity: Medium (CVSS 3.x base score 5.3)
CVSS v4: 8.7
EPSS exploit prediction: 1% (56th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2025-6735
Weakness: CWE-402
Affected product: Xwiki
Published: 2025-03-19
Last modified: 2026-06-17

Description

XWiki Platform is a generic wiki platform. Prior to 15.10.14, 16.4.6, and 16.10.0-rc-1, protected pages are listed when requesting the REST endpoints /rest/wikis/[wikiName]/pages even if the user doesn't have view rights on them. It's particularly true if the entire wiki is protected with "Prevent unregistered user to view pages": the endpoint would still list the pages of the wiki, though only for the main wiki. The problem has been patched in XWiki 15.10.14, 16.4.6, 16.10.0RC1. In those versions the endpoint can still be requested but the result is filtered out based on pages rights.

Frequently asked questions

What is CVE-2025-29925?: XWiki Platform is a generic wiki platform. Prior to 15.10.14, 16.4.6, and 16.10.0-rc-1, protected pages are listed when requesting the REST endpoints /rest/wikis/[wikiName]/pages even if the user doesn't have view rights on them. It's particularly true if the entire wiki is protected with "Prevent unregistered user to view pages": the endpoint would still list the pages of the wiki, though only for the main wiki. The problem has been patched in XWiki 15.10.14, 16.4.6, 16.10.0RC1. In those versions the endpoint can still be requested but the result is filtered out based on pages rights.
How severe is CVE-2025-29925?: CVE-2025-29925 has a CVSS 3.x base score of 5.3, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is low, integrity none, and availability none.
Is CVE-2025-29925 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (56th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2025-29925?: CVE-2025-29925 affects Xwiki. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2025-29925?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2025-29925 have an EU (EUVD) identifier?: Yes. CVE-2025-29925 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-6735.
When was CVE-2025-29925 published?: CVE-2025-29925 was published on 2025-03-19 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*

More vulnerabilities in Xwiki

CVE-2024-31996 — Critical (CVSS 10.0): XWiki Platform is a generic wiki platform. Starting in version 3.0.1 and prior to versions 4.10.19, 15.5.4, and…
CVE-2024-31982 — Critical (CVSS 10.0): XWiki Platform is a generic wiki platform. Starting in version 2.4-milestone-1 and prior to versions 4.10.20, 15.5.4,…
CVE-2024-21650 — Critical (CVSS 10.0): XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. XWiki is…
CVE-2023-46731 — Critical (CVSS 10.0): XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. XWiki doesn't…
CVE-2023-26477 — Critical (CVSS 10.0): XWiki Platform is a generic wiki platform. Starting in versions 6.3-rc-1 and 6.2.4, it's possible to inject arbitrary…
CVE-2025-53836 — Critical (CVSS 9.9): XWiki Rendering is a generic rendering system that converts textual input in a given syntax (wiki syntax, HTML, etc)…

All CVEs affecting Xwiki →

Other CWE-402 vulnerabilities

CVE-2025-0502 — Critical (CVSS 9.1): Transmission of Private Resources into a New Sphere ('Resource Leak') vulnerability in CrafterCMS Engine on Linux,…
CVE-2025-48383 — High (CVSS 8.2): Django-Select2 is a Django integration for Select2. Prior to version 8.4.1, instances of HeavySelect2Mixin subclasses…
CVE-2024-29900 — High (CVSS 7.5): Electron Packager bundles Electron-based application source code with a renamed Electron executable and supporting…
CVE-2022-3596 — High (CVSS 7.5): An information leak was found in OpenStack's undercloud. This flaw allows unauthenticated, remote attackers to inspect…
CVE-2025-67745 — High (CVSS 7.1): MyHoard is a daemon for creating, managing and restoring MySQL backups. Starting in version 1.0.1 and prior to version…
CVE-2024-47146 — Medium (CVSS 6.5): Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x could allow an attacker to obtain the devices serial…

Browse all CWE-402 vulnerabilities →