{"id":"CVE-2025-54125","summary":"XWiki Platform: Password and email exposure in xml.vm fields","details":"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. XWiki Platform Legacy Old Core and XWiki Platform Old Core versions 1.1 through 16.4.6, 16.5.0-rc-1 through 16.10.4 and 17.0.0-rc-1 through 17.1.0, the XML export of a page in XWiki that can be triggered by any user with view rights on a page by appending ?xpage=xml to the URL includes password and email properties stored on a document that aren't named password or email. This is fixed in versions 16.4.7, 16.10.5 and 17.2.0-rc-1. To work around this issue, the file templates/xml.vm in the deployed WAR can be deleted if the XML isn't needed. There isn't any feature in XWiki itself that depends on the XML export.","aliases":["GHSA-57q2-6cp4-9mq3"],"modified":"2026-08-12T15:16:40.808917Z","published":"2025-08-05T23:30:38.963Z","database_specific":{"cwe_ids":["CWE-359"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/54xxx/CVE-2025-54125.json","cna_assigner":"GitHub_M"},"references":[{"type":"WEB","url":"https://jira.xwiki.org/browse/XWIKI-22810"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/54xxx/CVE-2025-54125.json"},{"type":"ADVISORY","url":"https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-57q2-6cp4-9mq3"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-54125"},{"type":"FIX","url":"https://github.com/xwiki/xwiki-platform/commit/742ee3482ef6c2bd4ad03d0de9cdd81d0e8f3d59"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/xwiki/xwiki-commons","events":[{"introduced":"0"},{"fixed":"c3bb3381253c71df533fe0c31a02d3ce1e04bae7"},{"introduced":"526fcc68b3f75862a2af7395b5a6dfdd3d2166a5"},{"fixed":"da9d6819960ace1821a784a8441e523fe6fc94d5"},{"introduced":"e84d9bd1b4c0c8219597e10acfd8fbd692416294"},{"last_affected":"7f1dd9fba90aca38f2ab8d5325bf93c24543a730"}],"database_specific":{"cpe":"cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"1.1"},{"fixed":"16.4.7"},{"introduced":"16.5.0"},{"fixed":"16.10.5"},{"introduced":"17.0.0"},{"last_affected":"17.1.0"}],"source":"CPE_RANGE"}},{"type":"GIT","repo":"https://github.com/xwiki/xwiki-platform","events":[{"introduced":"e418311ea31a0bfb202414ef324369754eb9fe1f"},{"fixed":"f5a9a0762750936523187286919ec4c1892d6fea"},{"introduced":"177e524c2e218fe5de776619271b7cd12c929488"},{"fixed":"f7ffb1f0f550da6c1d6ce60643aa9759e83f99f3"},{"introduced":"7edb5b7d98170ec081c7e30237971d7dfb8a4401"},{"fixed":"742ee3482ef6c2bd4ad03d0de9cdd81d0e8f3d59"}],"database_specific":{"source":["CPE_RANGE","REFERENCES"],"cpe":"cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"1.1"},{"fixed":"16.4.7"},{"introduced":"16.5.0"},{"fixed":"16.10.5"},{"introduced":"17.0.0"},{"last_affected":"17.1.0"}]}}],"versions":["xwiki-commons-17.1.0","xwiki-commons-16.10.4","xwiki-commons-17.1.0-rc-1","xwiki-commons-16.10.3","xwiki-commons-16.10.2","xwiki-commons-16.4.6","xwiki-commons-16.10.1","xwiki-commons-16.10.0","xwiki-commons-16.10.0-rc-1","xwiki-commons-16.4.5","xwiki-commons-16.4.4","xwiki-commons-16.4.3","xwiki-commons-16.4.2","xwiki-commons-16.4.1","xwiki-commons-16.4.0","xwiki-commons-16.4.0-rc-1","xwiki-commons-8.3-milestone-2","xwiki-commons-8.3-milestone-1","xwiki-commons-8.2-milestone-2","xwiki-commons-8.2-milestone-1","xwiki-commons-8.1-milestone-2","xwiki-commons-8.1-milestone-1","xwiki-commons-8.0-milestone-2","xwiki-commons-8.0-milestone-1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-54125.json","vanir_signatures_modified":"2026-08-12T15:16:40Z","vanir_signatures":[{"digest":{"line_hashes":["116253179930766428168532364329171002083","37067409757970071408150387770668677173","320424597318912207514899867995036097807","180476897179326211153583594259258405432","236629517524165160830734471192479102333","117833685268915227386356212851990777614","114559724893280123107282731575396856989","288670380433486698357707786855784395655","147768348250042517025400936419634023832"],"threshold":0.9},"id":"CVE-2025-54125-045b464b","signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/742ee3482ef6c2bd4ad03d0de9cdd81d0e8f3d59","target":{"file":"xwiki-platform-core/xwiki-platform-filter/xwiki-platform-filter-instance/xwiki-platform-filter-instance-document/src/main/java/org/xwiki/filter/instance/input/DocumentInstanceInputProperties.java"},"deprecated":false},{"target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/test/java/com/xpn/xwiki/api/DocumentTest.java"},"deprecated":false,"digest":{"line_hashes":["155669118106017797388400908082479689734","46254585693802268014036497520402201611","184714438376055698038092557143191817383","33618357771697693124189316837617291763","166815641366930650574446054740514951763","316805421556054033476153710377640676684","35055676695254260984157680006984443616","55240013232567305589954460732021724941","24747777008384280104720869225459190847","264167089711321986563326463579007473328","191862352189347295900610683684671704882","79455943387692111294722349360023656275","214542572755399786128629491400904800754","211574229766822386141147940292219519907","205614066251606376757109032552210734049","195173105427273202450024475037491131280","271396545371159661947241571546803016598","219411354906959569191938045603138235894","192150034851059571492011786920361509270","33205969579569921976235655594267144434","302394132893555846193095799076405002235","5252715175168381181687828680346999974","224441478446581339766905545885143033964","2735896028436035660741693237276734854","15723278979384777827470772190469782688","55419409582737039155793808167590550360","112328065489508876849977806400677449185","267437169814020682127885184330061657553","183106456713300939688133789013886969101","169047409875825879275769490999323614364","325291012678653101894957571024763309107"],"threshold":0.9},"id":"CVE-2025-54125-154c5099","signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/742ee3482ef6c2bd4ad03d0de9cdd81d0e8f3d59"},{"deprecated":false,"digest":{"function_hash":"162592239907094141824549764744330838541","length":322},"id":"CVE-2025-54125-63edbe43","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/742ee3482ef6c2bd4ad03d0de9cdd81d0e8f3d59","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/api/Document.java","function":"getXMLContent"}},{"signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/742ee3482ef6c2bd4ad03d0de9cdd81d0e8f3d59","target":{"function":"write","file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/internal/filter/input/BaseObjectEventGenerator.java"},"deprecated":false,"digest":{"function_hash":"286671876569330565327368568639706491175","length":1088},"id":"CVE-2025-54125-8424742f","signature_type":"Function"},{"signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/742ee3482ef6c2bd4ad03d0de9cdd81d0e8f3d59","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/internal/filter/input/BaseObjectEventGenerator.java"},"deprecated":false,"digest":{"line_hashes":["234063185789416628764586381169116809475","241021916290166697362033013261493252166","135762397532841550182433837694265932715","17585715316810359992099106544266890492","239615398312449186185509233388195247377","16010794411704522522006908445314188149","294698897867800128680400861299872185591","303767504789083647381035508440695378475","233515334653208196040686775235808561171","194704246257225414028102806800030405049","339816964738006942227791274546836589171"],"threshold":0.9},"id":"CVE-2025-54125-882ec9b4","signature_type":"Line"},{"deprecated":false,"digest":{"line_hashes":["302872959928222412568992614144953497618","209130157030305553653246883855101211089","213721474446611684659845267679373063197","233082241354066570813448180093819670417","48992142150163792532016110092701502889","326951403612085448100830167304558728150","109399852841443390171931526583944911319","69458332352728482853115345921373684999","167821673527487270694454245053537512977","189904850424354021977446650871173225887","317197446589223762431330577006816295746","244883265243062335794769745605080295555","191380402075233854190656422475850059867","296589103551155653369861432336371919070","270212643768079890112253955547483629957","21141835682737743608092494001385486482","45734311595209084138009898852567064220","116532233828863163666500049793639368481"],"threshold":0.9},"id":"CVE-2025-54125-b7b24f30","signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/742ee3482ef6c2bd4ad03d0de9cdd81d0e8f3d59","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/api/Document.java"}}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"}]}