Arbitrary Page Creation Vulnerability in XWiki Application-Urlshortener
CVE-2025-48885

5.7MEDIUM

Key Information:

Vendor

Xwikisas

Status
Application-urlshortener
Vendor
CVE Published:
30 May 2025

What is CVE-2025-48885?

The application-urlshortener for XWiki enables users with view access to create arbitrary pages. This flaw allows any user, including guests, to produce unlimited documents with random names. Consequently, this can disrupt the organization of wiki pages, creating chaos that becomes increasingly hard for administrators to manage. Upgrading to version 1.2.4 mitigates this issue, as no workarounds are currently available. For detailed information, visit the advisory.

Affected Version(s)

application-urlshortener < 1.2.4

References

https://github.com/xwikisas/application-urlshortener/secu...
x_refsource_CONFIRM
https://github.com/xwikisas/application-urlshortener/comm...
x_refsource_MISC

CVSS V4

Score:
5.7
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2025-48885 : Arbitrary Page Creation Vulnerability in XWiki Application-Urlshortener