Skip to content
brandefense.io
Request A Demo
Vulnerability Intelligence

CVE-2025-54125

HighExploitedPublic exploit

XWiki exposes passwords and emails stored in fields not named password/email in xml.vm

Published Aug 5, 2025 · Updated Aug 12, 2026 · Also known as GHSA-57q2-6cp4-9mq3

Key Facts

Patch immediately
  • CVE-2025-54125 is a high-severity vulnerability (CVSS 8.7 v4) affecting Xwiki, org.xwiki.platform:xwiki-platform-legacy-oldcore (maven), org.xwiki.platform:xwiki-platform-oldcore (maven) and 1 more product.
  • It is exploited in the wild, listed in Industry KEV feed since Sep 6, 2025. Public exploit code is available.
  • EPSS estimates a 1.4% probability of exploitation in the next 30 days.
  • Fixed versions are available, including org.xwiki.platform:xwiki-platform-legacy-oldcore 16.10.5, org.xwiki.platform:xwiki-platform-legacy-oldcore 16.4.7, org.xwiki.platform:xwiki-platform-legacy-oldcore 17.2.0-rc-1.
  • Brandefense priority: patch immediately, because it is listed as exploited in the wild.

CVSS v4

8.7

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS (30-day exploit likelihood)

1.4%

Higher than 71.4% of all scored CVEs

Exploited in the wild

Yes

1 catalog listing

Public exploit code

Available

Proof-of-concept or weaponized module

Get the full CVE-2025-54125 brief as a PDF

Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.

Description

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. XWiki Platform Legacy Old Core and XWiki Platform Old Core versions 1.1 through 16.4.6, 16.5.0-rc-1 through 16.10.4 and 17.0.0-rc-1 through 17.1.0, the XML export of a page in XWiki that can be triggered by any user with view rights on a page by appending ?xpage=xml to the URL includes password and email properties stored on a document that aren't named password or email. This is fixed in versions 16.4.7, 16.10.5 and 17.2.0-rc-1. To work around this issue, the file templates/xml.vm in the deployed WAR can be deleted if the XML isn't needed. There isn't any feature in XWiki itself that depends on the XML export.

Known-Exploited Catalog Listings

CatalogAddedRemediation dueRansomware use
Industry KEV feedSep 6, 2025n/aNot reported

Required action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.

Affected Products

4 affected entries in total
ProductAffected versionsFixed in
XwikiXwikiSee advisory16.4.7
org.xwiki.platform:xwiki-platform-legacy-oldcoremaven>= 1.117.2.0-rc-1
org.xwiki.platform:xwiki-platform-oldcoremaven>= 1.117.2.0-rc-1
xwiki-platform>= >= 1.1, < 16.4.7n/a

Patched Releases

org.xwiki.platform:xwiki-platform-legacy-oldcore

16.10.5, 16.4.7, 17.2.0-rc-1

org.xwiki.platform:xwiki-platform-oldcore

16.10.5, 16.4.7, 17.2.0-rc-1

Xwiki

16.4.7

Timeline

  1. Publicly disclosed

    Aug 5, 2025

  2. Added to Industry KEV feed

    Sep 6, 2025

  3. Last updated

    Aug 12, 2026

Weakness Type

  • CWE-359 Exposure of Private Personal Information to an Unauthorized Actor

References

3 more references in the full CVE brief

FAQ

Common Questions.

Is CVE-2025-54125 Running On Your Attack Surface?

Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.

Request A Demo