CVE-2025-29926: The WikiManager REST API allows any user to create wikis

March 19, 2025 (updated October 31, 2025)

Any user can exploit the WikiManager REST API to create a new wiki, where the user could become an administrator and so performs other attacks on the farm. Note that this REST API is not bundled in XWiki Standard by default: it needs to be installed manually through the extension manager.

References

github.com/advisories/GHSA-gfp2-6qhm-7x43
github.com/xwiki/xwiki-platform
github.com/xwiki/xwiki-platform/commit/82aa670106c7f5e6238ca6ed59a52d1800e05b99
github.com/xwiki/xwiki-platform/security/advisories/GHSA-gfp2-6qhm-7x43
jira.xwiki.org/browse/XWIKI-22490
nvd.nist.gov/vuln/detail/CVE-2025-29926

Code Behaviors & Features

Detect and mitigate CVE-2025-29926 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →