---
id: CVE-2025-66473
title: XWiki is an open-source wiki software platform
summary: >-
  XWiki is an open-source wiki software platform. Versions 16.10.10 and below,
  17.0.0-rc-1 through 17.4.3 and 17.5.0-rc-1 through 17.6.0 contain a REST API
  which doesn't enforce any limits for the number of items that can be requested
  in a…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-770
vendor: xwiki
product: xwiki
affected:
  - xwiki < 16.10.11
  - 'xwiki >= 17.0.0, < 17.4.4'
  - 'xwiki >= 17.5.0, <= 17.6.0'
patched:
  - xwiki 17.4.4
published: '2025-12-10'
updated: '2026-09-25'
sourceUpdated: '2026-09-25T23:10:00.463'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-66473'
references:
  - url: >-
      https://github.com/xwiki/xwiki-platform/commit/e3c47745195fb445b054537be86f5c01ee69558b
    label: security-advisories@github.com
  - url: >-
      https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-cc84-q3v3-mhgf
    label: security-advisories@github.com
  - url: 'https://jira.xwiki.org/browse/XWIKI-23355'
    label: security-advisories@github.com
  - url: 'https://jira.xwiki.org/browse/XWIKI-23355'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
epss: 0.00403
epssPercentile: 0.31792
ingestedAt: '2026-09-25T23:21:16.942Z'
---

## Overview

XWiki is an open-source wiki software platform. Versions 16.10.10 and below, 17.0.0-rc-1 through 17.4.3 and 17.5.0-rc-1 through 17.6.0 contain a REST API which doesn't enforce any limits for the number of items that can be requested in a single request at the moment. Depending on the number of pages in the wiki and the memory configuration, this can lead to slowness and unavailability of the wiki. As an example, the /rest/wikis/xwiki/spaces resource returns all spaces on the wiki by default, which are basically all pages. This issue is fixed in versions 17.4.4 and 16.10.11.

## Affected

- `xwiki < 16.10.11`
- `xwiki >= 17.0.0, < 17.4.4`
- `xwiki >= 17.5.0, <= 17.6.0`

## Remediation

Upgrade past the affected range:

- `xwiki 17.4.4`