{"id":"CVE-2025-48885","summary":"application-urlshortener users can create arbitrary pages as long as they have view access to them","details":"application-urlshortener create shortened URLs for XWiki pages. Versions prior to 1.2.4 are vulnerable to users with view access being able to create arbitrary pages. Any user (even guests) can create these docs, even if they don't exist already. This can enable guest users to denature the structure of wiki pages, by creating 1000's of pages with random name, that then become very difficult to handle by admins. Version 1.2.4 fixes the issue. No known workarounds are available.","aliases":["GHSA-c57g-9v2r-w8v3"],"modified":"2026-08-12T14:52:41.441451Z","published":"2025-05-30T18:41:59.248Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-352"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/48xxx/CVE-2025-48885.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/48xxx/CVE-2025-48885.json"},{"type":"ADVISORY","url":"https://github.com/xwikisas/application-urlshortener/security/advisories/GHSA-c57g-9v2r-w8v3"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-48885"},{"type":"FIX","url":"https://github.com/xwikisas/application-urlshortener/commit/f121a9c973fd25948e82efcb6289d53fe00a9e7d"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/xwikisas/application-urlshortener","events":[{"introduced":"0"},{"fixed":"f121a9c973fd25948e82efcb6289d53fe00a9e7d"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"1.2.4"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["application-urlshortener-1.2.3","application-urlshortener-1.2.2","application-urlshortener-1.2.1","application-urlshortener-1.2","application-urlshortener-1.1.1","application-urlshortener-1.1","application-urlshortener-1.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-48885.json","vanir_signatures_modified":"2026-08-12T14:52:41Z","vanir_signatures":[{"target":{"file":"application-urlshortener-default/src/test/java/com/xwiki/urlshortener/internal/rest/DefaultURLShortenerResourceTest.java"},"deprecated":false,"digest":{"line_hashes":["53065371535740115669912798628045757436","76738824961157084985615220847696783930","278076977539641942674074385608241392019","60332503152274677147398824016862769293","188496605561010009014916086139955295478","153474917548728748893466318322449627694","70142444341981080893685720497963809243","243259789256974775006971781586240561359","178646577002597893504639985189093940698","153474917548728748893466318322449627694","102039619047111096715143764648622726392","253408748532053094334049015778953907799","324452709762582750066935067250120055411","326815099825926106548926991264909762157","222630912945582675179656806210178180603","116366436348337469574301061075782856847","242565768594524952293932961958802606752","190136835349965503870014078416861348992","91754570323261923792720644242193077950","71267621902821447243278427272385050275","305162063562918476441139215485096365233","66874108314583897743828163564347495131","224610923006572119078481538374058808855","158153716381833693445365111144162010891"],"threshold":0.9},"id":"CVE-2025-48885-1a5f1165","signature_type":"Line","signature_version":"v1","source":"https://github.com/xwikisas/application-urlshortener/commit/f121a9c973fd25948e82efcb6289d53fe00a9e7d"},{"target":{"file":"application-urlshortener-default/src/test/java/com/xwiki/urlshortener/internal/rest/DefaultURLShortenerResourceTest.java","function":"createShortenedURLWithObject"},"deprecated":false,"digest":{"function_hash":"240127175897113172112794680446630734727","length":639},"id":"CVE-2025-48885-755de2ce","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwikisas/application-urlshortener/commit/f121a9c973fd25948e82efcb6289d53fe00a9e7d"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/xwikisas/application-urlshortener/commit/f121a9c973fd25948e82efcb6289d53fe00a9e7d","target":{"file":"application-urlshortener-default/src/main/java/com/xwiki/urlshortener/internal/rest/DefaultURLShortenerResource.java","function":"createShortenedURL"},"deprecated":false,"digest":{"function_hash":"306143118416571143972972974254475157676","length":616},"id":"CVE-2025-48885-a778fd45"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/xwikisas/application-urlshortener/commit/f121a9c973fd25948e82efcb6289d53fe00a9e7d","target":{"file":"application-urlshortener-default/src/test/java/com/xwiki/urlshortener/internal/rest/DefaultURLShortenerResourceTest.java","function":"createShortenedURLWithoutObject"},"deprecated":false,"digest":{"function_hash":"198172631107442058129686866418384519024","length":1080},"id":"CVE-2025-48885-d4dac13b"},{"source":"https://github.com/xwikisas/application-urlshortener/commit/f121a9c973fd25948e82efcb6289d53fe00a9e7d","target":{"file":"application-urlshortener-default/src/main/java/com/xwiki/urlshortener/internal/rest/DefaultURLShortenerResource.java"},"deprecated":false,"digest":{"line_hashes":["18349062962687521287584361581241816512","279483329905906920746847651597957066234","289314449178476561527297333196845967457","208686452636205970510670472848522931944"],"threshold":0.9},"id":"CVE-2025-48885-dfe19d36","signature_type":"Line","signature_version":"v1"},{"digest":{"function_hash":"4531133678565052598992722234350426105","length":465},"id":"CVE-2025-48885-e8a94777","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwikisas/application-urlshortener/commit/f121a9c973fd25948e82efcb6289d53fe00a9e7d","target":{"file":"application-urlshortener-default/src/test/java/com/xwiki/urlshortener/internal/rest/DefaultURLShortenerResourceTest.java","function":"createShortenedURLWithoutViewAccess"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"277953810972998687025284635890030497927","length":1129},"id":"CVE-2025-48885-eb5f3eec","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwikisas/application-urlshortener/commit/f121a9c973fd25948e82efcb6289d53fe00a9e7d","target":{"file":"application-urlshortener-default/src/test/java/com/xwiki/urlshortener/internal/rest/DefaultURLShortenerResourceTest.java","function":"createShortenedURLWithErrorOnPageID"}}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P"}]}