CVE-2025-29926: The WikiManager REST API allows any user to create wikis

March 19, 2025

Any user can exploit the WikiManager REST API to create a new wiki, where the user could become an administrator and so performs other attacks on the farm. Note that this REST API is not bundled in XWiki Standard by default: it needs to be installed manually through the extension manager.

References

github.com/advisories/GHSA-gfp2-6qhm-7x43
github.com/xwiki/xwiki-platform
github.com/xwiki/xwiki-platform/commit/82aa670106c7f5e6238ca6ed59a52d1800e05b99
github.com/xwiki/xwiki-platform/security/advisories/GHSA-gfp2-6qhm-7x43
jira.xwiki.org/browse/XWIKI-22490
nvd.nist.gov/vuln/detail/CVE-2025-29926

Detect and mitigate CVE-2025-29926 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →