CVE-2025-65090

Description

XWiki Full Calendar Macro displays objects from the wiki on the calendar. Prior to version 2.4.6, users with the rights to view the Calendar.JSONService page (including guest users) can exploit the data leak vulnerability by accessing database info, with the exception of passwords. This issue has been patched in version 2.4.6.

PUBLISHED Reserved 2025-11-17 | Published 2026-01-10 | Updated 2026-01-12 | Assigner GitHub_M

Problem types

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

Product status

References

github.com/...lendar/security/advisories/GHSA-637h-ch24-xp9m

github.com/...ommit/25bc14c181c9a92f493b20ac264388c7ba171884

jira.xwiki.org/browse/FULLCAL-82

cve.org (CVE-2025-65090)

nvd.nist.gov (CVE-2025-65090)

Download JSON