XWiki-Platform - Information Disclosure (CVE-2025-29925)

CVE-2025-29925 is a high-severity vulnerability in XWiki Platform that allows unauthenticated users to enumerate protected page names via specific REST API endpoints, even when view permissions are restricted. This flaw could enable attackers to gather sensitive information about the structure and content of otherwise private wikis, potentially aiding in further targeted attacks or reconnaissance.

CrowdSec has been tracking this vulnerability and its exploits since 3rd of September 2025.

Insights from the CrowdSec network reveal that the attackers trying to exploit CVE-2025-29925 are composed of a fairly even mix of opportunistic and targeted actors. Some attackers employ preliminary reconnaissance, while others use indiscriminate scanning. CrowdSec network telemetry also shows that exploitation of CVE-2025-29925 has significantly declined over the past week. Attack volumes are well below the long-term average, suggesting attackers are rapidly losing interest. The vulnerability appears to be falling out of active use across most threat landscapes.

Attackers exploit this vulnerability by sending unauthenticated GET requests to REST API endpoints such as /rest/wikis/xwiki/pages or /xwiki/rest/wikis/xwiki/pages, allowing them to enumerate and access metadata about private XWiki pages.