CVE-2025-66473

HighCVSS 7.5

Published: 10/12/2025(UTC)Updated: 25/09/2026(UTC)Translated: 26/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.40%

32th percentile - higher than 32% of all known CVEs

Summary

Risk Assessment

This can cause slowness or unavailability of the wiki, disrupting access to information and user productivity.

Recommendation

Update XWiki to version 17.4.4 or 16.10.11, which fix this vulnerability.

Other vulnerabilities in XWiki

CVE-2026-48047Medium
XWiki Platform WebJars API, a package for XWiki, versions from 9.6-rc-1 to 16.10.17, 17.4.9, and 17.10.3 have a path traversal vulnerability that allows an attacker with a malicious WebJar extension installed to write arbitrary files. This requires admin access to a subwiki. Fixed in versions 16.10.17, 17.4.9, 17.10.3, and 18.0.0RC1.

Original NVD description (English source)

XWiki is an open-source wiki software platform. Versions 16.10.10 and below, 17.0.0-rc-1 through 17.4.3 and 17.5.0-rc-1 through 17.6.0 contain a REST API which doesn't enforce any limits for the number of items that can be requested in a single request at the moment. Depending on the number of pages in the wiki and the memory configuration, this can lead to slowness and unavailability of the wiki. As an example, the /rest/wikis/xwiki/spaces resource returns all spaces on the wiki by default, which are basically all pages. This issue is fixed in versions 17.4.4 and 16.10.11.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS