XWiki Platform: Password and email exposure in xml.vm fields
xwiki · xwiki-platform
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. XWiki Platform Legacy Old Core and XWiki Platform Old Core versions 1.1 through 16.4.6, 16.5.0-rc-1 through 16.10.4 and 17.0.0-rc-1 through 17.1.0, the XML export of a page in XWiki that can be triggered by any user with view rights on a page by appending ?xpage=xml to the URL includes password and email properties stored on a document that aren't named password or email. This is fixed in versions 16.4.7, 16.10.5 and 17.2.0-rc-1. To work around this issue, the file templates/xml.vm in the deployed WAR can be deleted if the XML isn't needed. There isn't any feature in XWiki itself that depends on the XML export.
- Exploited
- Yes, in VulnCheck KEV
- Reports
- 0
- Tactics
- 0/15
Exploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.
First seen exploited 32 days after disclosure.
- Disclosedday 0
- First seen exploitedVulnCheck KEV evidence+32 days
Patch historyEarlier and later CVEs in the same code, in date order. It shows when a fix was bypassed or incomplete and which version finally fixed it.
7 fixes in xwiki-platform-oldcore over 10 months. The latest fix listed for xwiki-platform-oldcore is 17.10.1.
Fixes in xwiki-platform-oldcoreMaven package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.
- 16.10.2CVE-2024-5615812 Jun 2025
- 17.0.0CVE-2025-4958613 Jun 2025
- 17.2.0-rc-1CVE-2025-541245 Aug 2025
- 17.2.0-rc-1CVE-2025-541255 Aug 2025
- 17.3.0-rc-1CVE-2025-5438526 Jul 2025
- 17.10.1CVE-2026-332298 Apr 2026
- 17.10.1CVE-2026-4010415 Apr 2026Latest listed
MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques
No techniques linkedNo ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.
Am I affected? What do I upgrade to?
From GitHub Security Advisories and OSV2 packages in 1 ecosystem. No single main package: each of these ships the affected code.
- Mavenorg.xwiki.platform:xwiki-platform-oldcoreAffected: 17.0.0-rc-1 up to 17.2.0-rc-1; 16.5.0-rc-1 up to 16.10.5; 1.1 up to 16.4.7Upgrade to 16.10.5 (older lines: 17.2.0-rc-1, 16.4.7)
- Mavenorg.xwiki.platform:xwiki-platform-legacy-oldcoreAffected: 17.0.0-rc-1 up to 17.2.0-rc-1; 16.5.0-rc-1 up to 16.10.5; 1.1 up to 16.4.7Upgrade to 16.10.5 (older lines: 17.2.0-rc-1, 16.4.7)