CVE-2025-46554 describes an information disclosure vulnerability in XWiki versions 1.8.1 through 14.10.21, 15.0-rc-1 through 15.10.11, 16.0.0-rc-1 through 16.4.2, and 16.5.0-rc-1 through 16.6.9. This flaw allows unauthenticated users to access metadata of any attachment via the wiki attachment REST endpoint, even in private wikis, due to a lack of access control filtering. Rated as MEDIUM severity (CVSS 5.3), the vulnerability has a low impact on confidentiality and no impact on integrity or availability. While there is no evidence of active exploitation, Nuclei templates exist for detection, and there is no significant community discussion or media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 1.8.1, < 14.10.22CPE matchmatch criteria | cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:* | ||
>= 15.0, < 15.10.12CPE matchmatch criteria | cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:* | ||
>= 16.0.0, < 16.4.3CPE matchmatch criteria | cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:* | ||
>= 16.5.0, < 16.7.0CPE matchmatch criteria | cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.