CVE-2025-48885

Vulnerability

The XWiki URL Shortener application (application-urlshortener) prior to version 1.2.4 lacks a check for whether a target document already exists before creating a short URL. This allows any user with view access—including unauthenticated guests—to create arbitrary pages in the wiki [1][2]. The root cause is that the shortener endpoint does not verify document existence before proceeding with creation.

Exploitation

An attacker can exploit this by issuing a crafted POST request to the URL shortener's REST endpoint, specifying a currentDocRef parameter for a non-existent page. For example:

curl -X POST -k -i 'http://localhost:8080/rest/p/create?currentDocRef=xwiki:caubin.test.WebHome'

Even without authentication, the request creates the specified document and adds a short URL object to it. No special privileges or prior knowledge of the wiki structure are required [2].

Impact

A guest user can mass-create thousands of pages with random names, making it extremely difficult for administrators to manage the wiki's page hierarchy. This effectively denatures the wiki structure and imposes a significant administrative burden. The vulnerability does not directly allow code execution or data theft, but it can disrupt normal wiki operations [2].

Mitigation

Version 1.2.4 of the URL Shortener fixes this issue by adding a check to ensure the target document already exists before creating the short URL [1]. No workarounds are available; users must upgrade to the patched version. The vulnerability is not known to be exploited in the wild, but the ease of exploitation warrants immediate patching.