High · published December 11, 2025
⚡ Unrestricted API calls could be your wiki's worst nightmare! An attacker can request all pages in one go, potentially crashing the service. 🔥 Think of it like a buffet with no limits—guests can pile their plates high, leaving no room for others to eat. If too many queries hit the wiki at once, it's like everyone trying to grab food at the same time, causing a serious traffic jam! If exploited, an attacker could overwhelm your XWiki instance with excessive requests, leading to slowness or even complete unavailability. Imagine your wiki turning into a ghost town, inaccessible when users need it the most! This could severely disrupt collaboration and information sharing.
Think of it like a buffet with no limits—guests can pile their plates high, leaving no room for others to eat. If too many queries hit the wiki at once, it's like everyone trying to grab food at the same time, causing a serious traffic jam! This vulnerability in XWiki's REST API allows for an unlimited number of items to be requested in a single call. This can overload the server based on the number of pages present, causing performance issues or crashes.
If exploited, an attacker could overwhelm your XWiki instance with excessive requests, leading to slowness or even complete unavailability. Imagine your wiki turning into a ghost town, inaccessible when users need it the most! This could severely disrupt collaboration and information sharing. Update your XWiki installation to versions 17.4.4 or 16.10.11 to patch this vulnerability. Additionally, consider implementing rate limiting on your API to prevent excessive requests in the future. Regularly monitor your API usage for unusual patterns! You've got this! With these updates and precautions, you can keep your wiki running smoothly and protect it from potential overloads! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| xwiki/xwiki | < 16.10.11 | 16.10.11 |
| xwiki/xwiki | ≥ 17.0.0, < 17.4.4 | 17.4.4 |
| xwiki/xwiki | ≥ 17.5.0, ≤ 17.6.0 | — |