xwiki xwiki-platform up to 16.10.10/17.4.3/17.6.x REST API /rest/wikis/xwiki/spaces allocation of resources

Summaryinfo

A vulnerability identified as problematic has been detected in xwiki xwiki-platform up to 16.10.10/17.4.3/17.6.x. Affected is an unknown function of the file /rest/wikis/xwiki/spaces of the component REST API. This manipulation causes allocation of resources. This vulnerability is registered as CVE-2025-66473. Remote exploitation of the attack is possible. No exploit is available. You should upgrade the affected component.

Detailsinfo

A vulnerability has been found in xwiki xwiki-platform up to 16.10.10/17.4.3/17.6.x and classified as problematic. Affected by this vulnerability is some unknown functionality of the file /rest/wikis/xwiki/spaces of the component REST API. The manipulation with an unknown input leads to a allocation of resources vulnerability. The CWE definition for the vulnerability is CWE-770. The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor. As an impact it is known to affect availability. The summary by CVE is:

XWiki is an open-source wiki software platform. Versions 16.10.10 and below, 17.0.0-rc-1 through 17.4.3 and 17.5.0-rc-1 through 17.6.0 contain a REST API which doesn't enforce any limits for the number of items that can be requested in a single request at the moment. Depending on the number of pages in the wiki and the memory configuration, this can lead to slowness and unavailability of the wiki. As an example, the /rest/wikis/xwiki/spaces resource returns all spaces on the wiki by default, which are basically all pages. This issue is fixed in versions 17.4.4 and 16.10.11.

The advisory is shared at github.com. This vulnerability is known as CVE-2025-66473 since 12/02/2025. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1499 for this issue.

Upgrading to version 16.10.11, 17.4.4 or 17.7.0-rc-1 eliminates this vulnerability. Applying the patch e3c47745195fb445b054537be86f5c01ee69558b is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at CERT Bund (WID-SEC-2025-2811). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Affected

• Open Source xwiki

Productinfo

Type

• Content Management System

Vendor

• xwiki

Name

• xwiki-platform

Version

• 16.10.0
• 16.10.1
• 16.10.2
• 16.10.3
• 16.10.4
• 16.10.5
• 16.10.6
• 16.10.7
• 16.10.8
• 16.10.9
• 16.10.10
• 17.0
• 17.1
• 17.2
• 17.3
• 17.4
• 17.4.0
• 17.4.1
• 17.4.2
• 17.4.3
• 17.5
• 17.6

License

• open-source

Website

• Product: https://github.com/xwiki/xwiki-platform/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion