CVE-2025-29926

XWiki Platform is a generic wiki platform. Prior to 15.10.15, 16.4.6, and 16.10.0, any user can exploit the WikiManager REST API to create a new wiki, where the user could become an administrator and so performs other attacks on the farm. Note that this REST API is not bundled in XWiki Standard by default: it needs to be installed manually through the extension manager. The problem has been patched in versions 15.10.15, 16.4.6 and 16.10.0 of the REST module.

• CWE-285
• CWE-862

• https://github.com/xwiki/xwiki-platform/commit/82aa670106c7f5e6238ca6ed59a52d1800e05b99Patch
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-gfp2-6qhm-7x43Vendor Advisory
• https://jira.xwiki.org/browse/XWIKI-22490Exploit, Issue Tracking, Vendor Advisory

Published

Mar 19, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-29918Suricata is a network Intrusion Detection System, Intrusion …5.5
• CVE-2025-2992A vulnerability classified as critical was found in Tenda FH…6.9
• CVE-2025-29922kcp is a Kubernetes-like control plane for form-factors and …9.6
• CVE-2025-29923go-redis is the official Redis client library for the Go pro…3.7
• CVE-2025-29924XWiki Platform is a generic wiki platform. Prior to 15.10.14…7.5
• CVE-2025-29925XWiki Platform is a generic wiki platform. Prior to 15.10.14…5.3
• CVE-2025-29927Next.js is a React framework for building full-stack web app…9.1
• CVE-2025-29928authentik is an open-source identity provider. Prior to vers…8
• CVE-2025-29929Tuleap is an Open Source Suite to improve management of soft…4.3
• CVE-2025-2993A vulnerability, which was classified as critical, has been …6.9
• CVE-2025-29930imFAQ is an advanced questions and answers management system…6.9
• CVE-2025-29931A vulnerability has been identified in TeleControl Server Ba…6.3