CVE-2025-54125: XWiki XML Export Vulnerability Exposing Sensitive User Data
Summary
CVE-2025-54125: XWiki exposes passwords and emails stored in fields not named password/email in xml.vm. Affects org.xwiki.platform:xwiki-platform-oldcore across 3 version ranges.
>= 1.1, < 16.4.7
>= 16.5.0-rc-1, < 16.10.5
>= 17.0.0-rc-1, < 17.2.0-rc-1
Fixed in 16.4.7, 16.10.5 or 17.2.0-rc-1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
XWiki is a powerful open-source wiki platform that allows users to create, manage, and share content collaboratively. It offers features such as document versioning, user rights management, and extensibility through plugins. However, a vulnerability has been identified in the XML export functionality, which can potentially expose sensitive user information.
Vulnerability Detail
The vulnerability arises from the XML export feature of XWiki, which can be accessed by any user with view rights on a page by appending '?xpage=xml' to the URL. This export includes password and email properties stored in documents that do not explicitly use the names 'password' or 'email'. As a result, users can obtain salted and hashed user account validation tokens or password reset tokens. Although the immediate impact is low since actual passwords and emails are not exposed, there is a risk if custom extensions store sensitive data in non-standard fields.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 1.1, < 16.4.716.4.7 -
>= 16.5.0-rc-1, < 16.10.516.10.5 -
>= 17.0.0-rc-1, < 17.2.0-rc-117.2.0-rc-1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If the XML export feature is not needed, you can delete the file 'templates/xml.vm' from the deployed WAR to prevent any potential exploitation of this vulnerability.
Conclusion
In summary, CVE-2025-54125 is a significant vulnerability in XWiki's XML export functionality that can expose sensitive user data. It is crucial for users to update to the patched versions or implement the suggested workaround to mitigate potential risks.
See every vulnerability recorded for org.xwiki.platform:xwiki-platform-oldcore →
FAQ
CVE-2025-54125 is a vulnerability in XWiki that allows unauthorized access to sensitive user data through the XML export feature.
You can check your application for this vulnerability using Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to use the Vulert playground without signup.
The main risk is the exposure of salted and hashed validation tokens, which could potentially be exploited if custom extensions store sensitive data in non-standard fields.
If you cannot update, consider implementing the provided workaround by deleting the 'templates/xml.vm' file to mitigate the risk.
No, there is no core feature in XWiki that relies on the XML export, so it can be safely removed if not needed.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.xwiki.platform:xwiki-platform-oldcore.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
