CVE-2025-29926: The WikiManager REST API allows any user to create wikis
Impact
Any user can exploit the WikiManager REST API to create a new wiki, where the user could become an administrator and so performs other attacks on the farm. Note that this REST API is not bundled in XWiki Standard by default: it needs to be installed manually through the extension manager.
Patches
The problem has been patched in versions 15.10.15, 16.4.6 and 16.10.0 of the REST module.
Workarounds
There's no workaround other than upgrading the dependency.
References
JIRA ticket: https://jira.xwiki.org/browse/XWIKI-22490 Commit of the fix: https://github.com/xwiki/xwiki-platform/commit/82aa670106c7f5e6238ca6ed59a52d1800e05b99
For more information
If you have any questions or comments about this advisory: Open an issue in Jira XWiki.org Email us at Security Mailing List
Attribution
You can specify here who reported the issue.
Other sources
XWiki Platform is a generic wiki platform. Prior to 15.10.15, 16.4.6, and 16.10.0, any user can exploit the WikiManager REST API to create a new wiki, where the user could become an administrator and so performs other attacks on the farm. Note that this REST API is not bundled in XWiki Standard by default: it needs to be installed manually through the extension manager. The problem has been patched in versions 15.10.15, 16.4.6 and 16.10.0 of the REST module.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.xwiki.platform:xwiki-platform-wiki-rest-defaultto a version that resolves this vulnerability.Fixed in 16.10.0 - Upgrade
Upgrade
maven/org.xwiki.platform:xwiki-platform-wiki-rest-defaultto a version that resolves this vulnerability.Fixed in 16.4.6 - Upgrade
Upgrade
maven/org.xwiki.platform:xwiki-platform-wiki-rest-defaultto a version that resolves this vulnerability.Fixed in 15.10.15 - Upgrade
Upgrade
XWiki Platform REST module (WikiManager REST API)to a version that resolves this vulnerability.Fixed in 15.10.15 - Upgrade
Upgrade
XWiki Platform REST module (WikiManager REST API)to a version that resolves this vulnerability.Fixed in 16.4.6 - Upgrade
Upgrade
XWiki Platform REST module (WikiManager REST API)to a version that resolves this vulnerability.Fixed in 16.10.0
Event History
Frequently Asked Questions
What is the severity of CVE-2025-29926?
CVE-2025-29926 is considered a high-severity vulnerability as it allows unauthorized users to create wikis and gain administrative access.
How do I fix CVE-2025-29926?
To fix CVE-2025-29926, upgrade to XWiki Platform versions 15.10.15, 16.4.6, or 16.10.0 or later.
Who is affected by CVE-2025-29926?
CVE-2025-29926 affects all versions of XWiki Platform prior to 15.10.15, 16.4.6, and 16.10.0.
What type of attacks can be performed due to CVE-2025-29926?
Due to CVE-2025-29926, attackers can create new wikis and escalate privileges, potentially leading to further attacks on the wiki platform.
Is the WikiManager REST API also affected by CVE-2025-29926?
Yes, the WikiManager REST API is specifically the vector that allows exploitation in CVE-2025-29926.