# CVE-2025-54125: XWiki-Platform - Credentials Disclosure

> Live exploitation tracking for CVE-2025-54125 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2025-54125

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 8.7
- **Public exploit available:** Yes
- **Affected products:** XWiki-Platform
- **Weaknesses:** CWE-359 (Exposure of Private Personal Information to an Unauthorized Actor)
- **Tags:** wiki

## Description

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. XWiki Platform Legacy Old Core and XWiki Platform Old Core versions 1.1 through 16.4.6, 16.5.0-rc-1 through 16.10.4 and 17.0.0-rc-1 through 17.1.0, the XML export of a page in XWiki that can be triggered by any user with view rights on a page by appending ?xpage=xml to the URL includes password and email properties stored on a document that aren't named password or email. This is fixed in versions 16.4.7, 16.10.5 and 17.2.0-rc-1. To work around this issue, the file templates/xml.vm in the deployed WAR can be deleted if the XML isn't needed. There isn't any feature in XWiki itself that depends on the XML export.

## CrowdSec analysis

[CVE-2025-54125](https://euvd.enisa.europa.eu/vulnerability/CVE-2025-54125) is a high-severity vulnerability in XWiki Platform that allows any user with view rights to export sensitive information, such as passwords and emails stored under non-standard property names, by appending ?xpage=xml to a page URL. This flaw could be exploited by attackers to harvest confidential user data, potentially leading to further compromise or targeted attacks.

CrowdSec has been tracking this vulnerability and its exploits since 3rd of September 2025.

CrowdSec has not observed any significant exploitation activity targeting CVE-2025-54125 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Attackers exploit this vulnerability by sending GET requests to user profile endpoints such as `/bin/view/XWiki/<username>?xpage=xml` or `/xwiki/bin/view/XWiki/<username>?xpage=xml`, which return XML data containing sensitive user information.

## Timeline

- 2025-08-05: CVE Published. CVE-2025-54125 is published to NVD.
- 2025-09-03: Rule Released. CrowdSec releases a rule to detect CVE-2025-54125 exploitation attempts against the CrowdSec Network.
- 2025-09-06: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2025-54125 for the first time.

## References

- https://github.com/xwiki/xwiki-platform/commit/742ee3482ef6c2bd4ad03d0de9cdd81d0e8f3d59
- https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-57q2-6cp4-9mq3
- https://jira.xwiki.org/browse/XWIKI-22810
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-54125.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2025-54125) follows observed exploitation activity for CVE-2025-54125. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.