Which products and versions are affected by CVE-2025-29925?

Affected: Xwiki; org.xwiki.platform:xwiki-platform-rest-server (maven) versions >= 1.9M1; xwiki-platform versions >= >= 1.9M1, < 15.10.14. The full list is in the CVE brief.

Is CVE-2025-29925 being exploited in the wild?

It is exploited in the wild, listed in Industry KEV feed since Sep 4, 2025.

Is CVE-2025-29925 in the CISA KEV catalog?

No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.

Is there a public exploit for CVE-2025-29925?

Public exploit code is available.

Is there a fix for CVE-2025-29925?

Fixed versions are available, including org.xwiki.platform:xwiki-platform-rest-server 15.10.14, org.xwiki.platform:xwiki-platform-rest-server 16.10.0-rc-1, org.xwiki.platform:xwiki-platform-rest-server 16.4.6.

How urgently should CVE-2025-29925 be patched?

Brandefense priority: patch immediately, because it is listed as exploited in the wild.

Request A Demo

Vulnerability Intelligence

CVE-2025-29925

Q: What is CVE-2025-29925?

XWiki Platform is a generic wiki platform.

Q: Is CVE-2025-29925 being exploited in the wild?

It is exploited in the wild, listed in Industry KEV feed since Sep 4, 2025.

Q: Is CVE-2025-29925 in the CISA KEV catalog?

No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.

Q: Is there a public exploit for CVE-2025-29925?

Public exploit code is available.

Q: Is there a fix for CVE-2025-29925?

Fixed versions are available, including org.xwiki.platform:xwiki-platform-rest-server 15.10.14, org.xwiki.platform:xwiki-platform-rest-server 16.10.0-rc-1, org.xwiki.platform:xwiki-platform-rest-server 16.4.6.

Q: How urgently should CVE-2025-29925 be patched?

Brandefense priority: patch immediately, because it is listed as exploited in the wild.

HighExploitedPublic exploit

XWiki allows unregistered users to access private pages information through REST endpoint

Published Mar 19, 2025 · Updated Aug 12, 2026 · Also known as GHSA-22q5-9phm-744v

Key Facts

Patch immediately

CVE-2025-29925 is a high-severity vulnerability (CVSS 8.7 v4) affecting Xwiki, org.xwiki.platform:xwiki-platform-rest-server (maven), xwiki-platform.
It is exploited in the wild, listed in Industry KEV feed since Sep 4, 2025. Public exploit code is available.
EPSS estimates a 0.9% probability of exploitation in the next 30 days.
Fixed versions are available, including org.xwiki.platform:xwiki-platform-rest-server 15.10.14, org.xwiki.platform:xwiki-platform-rest-server 16.10.0-rc-1, org.xwiki.platform:xwiki-platform-rest-server 16.4.6.
Brandefense priority: patch immediately, because it is listed as exploited in the wild.

CVSS v4

8.7

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS (30-day exploit likelihood)

0.9%

Higher than 60.5% of all scored CVEs

Exploited in the wild

Yes

1 catalog listing

Public exploit code

Available

Proof-of-concept or weaponized module

Get the full CVE-2025-29925 brief as a PDF

Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.

Description

XWiki Platform is a generic wiki platform. Prior to 15.10.14, 16.4.6, and 16.10.0-rc-1, protected pages are listed when requesting the REST endpoints /rest/wikis/[wikiName]/pages even if the user doesn't have view rights on them. It's particularly true if the entire wiki is protected with "Prevent unregistered user to view pages": the endpoint would still list the pages of the wiki, though only for the main wiki. The problem has been patched in XWiki 15.10.14, 16.4.6, 16.10.0RC1. In those versions the endpoint can still be requested but the result is filtered out based on pages rights.

Known-Exploited Catalog Listings

Catalog	Added	Remediation due	Ransomware use
Industry KEV feed	Sep 4, 2025	n/a	Not reported

Required action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.

Affected Products

3 affected entries in total

Product	Affected versions	Fixed in
XwikiXwiki	See advisory	15.10.14
org.xwiki.platform:xwiki-platform-rest-servermaven	>= 1.9M1	15.10.14
xwiki-platform	>= >= 1.9M1, < 15.10.14	n/a

Patched Releases

org.xwiki.platform:xwiki-platform-rest-server

15.10.14, 16.10.0-rc-1, 16.4.6

Xwiki

15.10.14

Timeline

Publicly disclosed
Mar 19, 2025
Added to Industry KEV feed
Sep 4, 2025
Last updated
Aug 12, 2026

Weakness Type

CWE-402 Transmission of Private Resources into a New Sphere ('Resource Leak')

References

5 more references in the full CVE brief

FAQ

Common Questions.

XWiki Platform is a generic wiki platform.
Affected: Xwiki; org.xwiki.platform:xwiki-platform-rest-server (maven) versions >= 1.9M1; xwiki-platform versions >= >= 1.9M1, < 15.10.14. The full list is in the CVE brief.
It is exploited in the wild, listed in Industry KEV feed since Sep 4, 2025.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
Public exploit code is available.
Fixed versions are available, including org.xwiki.platform:xwiki-platform-rest-server 15.10.14, org.xwiki.platform:xwiki-platform-rest-server 16.10.0-rc-1, org.xwiki.platform:xwiki-platform-rest-server 16.4.6.
Brandefense priority: patch immediately, because it is listed as exploited in the wild.

Is CVE-2025-29925 Running On Your Attack Surface?

Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.

Request A Demo