CVE-2025-48885

application-urlshortener create shortened URLs for XWiki pages. Versions prior to 1.2.4 are vulnerable to users with view access being able to create arbitrary pages. Any user (even guests) can create these docs, even if they don't exist already. This can enable guest users to denature the structure of wiki pages, by creating 1000's of pages with random name, that then become very difficult to handle by admins. Version 1.2.4 fixes the issue. No known workarounds are available.

CVSS

No CVSS.

References

Link	Resource
https://github.com/xwikisas/application-urlshortener/commit/f121a9c973fd25948e82efcb6289d53fe00a9e7d
https://github.com/xwikisas/application-urlshortener/security/advisories/GHSA-c57g-9v2r-w8v3

Configurations

No configuration.

History

15 Apr 2026, 00:35

Type	Values Removed	Values Added
Summary		(es) application-urlshortener crea URLs acortadas para páginas XWiki. Las versiones anteriores a la 1.2.4 son vulnerables a que los usuarios con acceso de vista puedan crear páginas arbitrarias. Cualquier usuario (incluso invitados) puede crear estos documentos, incluso si no existen. Esto puede permitir que los invitados desnaturalicen la estructura de las páginas wiki, creando miles de páginas con nombres aleatorios, que luego se vuelven muy difíciles de gestionar para los administradores. La versión 1.2.4 soluciona el problema. No se conocen workarounds.

30 May 2025, 19:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-05-30 19:15

Updated : 2026-06-17 09:30

NVD link : CVE-2025-48885

Mitre link : CVE-2025-48885

CVE.ORG link : CVE-2025-48885

JSON object : View

Products Affected

No product.

CWE

CWE-352

Cross-Site Request Forgery (CSRF)

{"id": "CVE-2025-48885", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-48885", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-05-30T20:37:37.672943Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "PROOF_OF_CONCEPT", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "xwikisas", "product": "application-urlshortener", "versions": [{"status": "affected", "version": "< 1.2.4"}]}]}], "published": "2025-05-30T19:15:29.723", "references": [{"url": "https://github.com/xwikisas/application-urlshortener/commit/f121a9c973fd25948e82efcb6289d53fe00a9e7d", "source": "security-advisories@github.com"}, {"url": "https://github.com/xwikisas/application-urlshortener/security/advisories/GHSA-c57g-9v2r-w8v3", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-352"}]}], "descriptions": [{"lang": "en", "value": "application-urlshortener create shortened URLs for XWiki pages. Versions prior to 1.2.4 are vulnerable to users with view access being able to create arbitrary pages. Any user (even guests) can create these docs, even if they don't exist already. This can enable guest users to denature the structure of wiki pages, by creating 1000's of pages with random name, that then become very difficult to handle by admins. Version 1.2.4 fixes the issue. No known workarounds are available."}, {"lang": "es", "value": "application-urlshortener crea URLs acortadas para p\u00e1ginas XWiki. Las versiones anteriores a la 1.2.4 son vulnerables a que los usuarios con acceso de vista puedan crear p\u00e1ginas arbitrarias. Cualquier usuario (incluso invitados) puede crear estos documentos, incluso si no existen. Esto puede permitir que los invitados desnaturalicen la estructura de las p\u00e1ginas wiki, creando miles de p\u00e1ginas con nombres aleatorios, que luego se vuelven muy dif\u00edciles de gestionar para los administradores. La versi\u00f3n 1.2.4 soluciona el problema. No se conocen workarounds."}], "lastModified": "2026-06-17T09:30:25.967", "sourceIdentifier": "security-advisories@github.com"}