xwiki-platform up to 16.4.6/16.10.4/17.1.x templates/xml.vm private personal information

Summaryinfo

A vulnerability categorized as problematic has been discovered in xwiki-platform up to 16.4.6/16.10.4/17.1.x. Affected is an unknown function of the file templates/xml.vm. The manipulation results in private personal information. This vulnerability is known as CVE-2025-54125. It is possible to launch the attack remotely. No exploit is available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, was found in xwiki-platform up to 16.4.6/16.10.4/17.1.x. Affected is an unknown functionality of the file templates/xml.vm. The manipulation with an unknown input leads to a private personal information vulnerability. CWE is classifying the issue as CWE-359. The product does not properly prevent a person's private, personal information from being accessed by actors who either (1) are not explicitly authorized to access the information or (2) do not have the implicit consent of the person about whom the information is collected. This is going to have an impact on confidentiality. CVE summarizes:

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. XWiki Platform Legacy Old Core and XWiki Platform Old Core versions 1.1 through 16.4.6, 16.5.0-rc-1 through 16.10.4 and 17.0.0-rc-1 through 17.1.0, the XML export of a page in XWiki that can be triggered by any user with view rights on a page by appending ?xpage=xml to the URL includes password and email properties stored on a document that aren't named password or email. This is fixed in versions 16.4.7, 16.10.5 and 17.2.0-rc-1. To work around this issue, the file templates/xml.vm in the deployed WAR can be deleted if the XML isn't needed. There isn't any feature in XWiki itself that depends on the XML export.

The advisory is shared for download at github.com. This vulnerability is traded as CVE-2025-54125 since 07/17/2025. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1589.

Upgrading to version 16.4.7, 16.10.5 or 17.2.0-rc-1 eliminates this vulnerability. Applying the patch 742ee3482ef6c2bd4ad03d0de9cdd81d0e8f3d59 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at CERT Bund (WID-SEC-2025-1729). Once again VulDB remains the best source for vulnerability data.

Affected

• Open Source xwiki

Productinfo

Type

• Content Management System

Name

• xwiki-platform

Version

• 16.4.0
• 16.4.1
• 16.4.2
• 16.4.3
• 16.4.4
• 16.4.5
• 16.4.6
• 16.10.0
• 16.10.1
• 16.10.2
• 16.10.3
• 16.10.4
• 17.0
• 17.1

License

• open-source

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion