XWiki Platform CVE-2025-66473

No special conditions - remote unauthenticated exploitation against default configurations of XWiki, since the vulnerable REST resources (e.g. /rest/wikis/xwiki/spaces) are reachable without authentication and enforce no result-count limit prior to the fix. The practical severity is gated by deployment scale: impact ('slowness and unavailability') grows with the number of pages in the wiki and the JVM memory configuration, so large wikis are meaningfully affected while small instances may only degrade. Limiting factors are that the affected versions must be pre-patch (≤16.10.10, 17.0.0-rc-1-17.4.3, 17.5.0-rc-1-17.6.0) and that the only mitigation short of upgrading is proxy-level denial of access to the affected endpoints.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H) describes an unauthenticated, network-reachable, low-complexity availability-only attack, which drives the elevated 8.7 base score. However, effective risk is more moderate than that number suggests: the impact is confined to denial of service (CWE-770 uncontrolled resource consumption) with no confidentiality or integrity loss (VC:N/VI:N), and severity scales with wiki size - the advisory explicitly notes impact 'depends on the number of pages in the wiki and the memory configuration,' so small or lightly-populated instances are far less exposed to OOM/unavailability. Corroborating signals point away from urgent priority: EPSS is low at 0.40% (32nd percentile), there is no CISA KEV listing, and no public exploit code is identified - though the trivial nature of the attack (a single unauthenticated GET to /rest/wikis/xwiki/spaces) means weaponization is easy despite the absence of a published PoC. Net assessment: a genuine but bounded availability issue, worth patching on large multi-tenant or internet-exposed XWiki deployments but not a drop-everything emergency for typical installs.

An unauthenticated remote attacker sends a request to an unbounded REST resource such as GET /rest/wikis/xwiki/spaces, which by default returns every space (effectively every page) on the wiki. On a large wiki the server attempts to serialize the entire result set into memory, causing severe slowness, out-of-memory conditions, and unavailability; repeating the request amplifies the effect. No public exploit code is identified, but the attack requires only a single crafted HTTP request with no authentication.