The pad management logic in XWiki labs CryptPad before 3.0.0 allows a remote attacker (who has access to a Rich Text pad with editing rights for the URL) to corrupt it (i.e., cause data loss) via a trivial URL modification.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:NXwiki Cryptpad
APPXwiki< 3.0.0
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
Related vulnerabilities
CVE-2025-51846HIGH8.7same product
CryptPad 2025.3.1 allows unbounded WebSocket frame flood. A remote, unauthenticated attacker can significantly...
CVE-2025-49591HIGH7.4same product
CryptPad is a collaboration suite. Prior to version 2025.3.0, enforcement of Two-Factor Authentication (2FA) i...
CVE-2017-1000051MEDIUM6.1same product
Cross-site scripting (XSS) vulnerability in pad export in XWiki labs CryptPad before 1.1.1 allows remote attac...
CVE-2025-49590LOW2.9same product
CryptPad to pakiet narzędzi do współpracy. Przed wersją 2025.3.0 funkcjonalność "Link Bouncer" próbuje filtrow...
CVE-2025-24893CRITICAL9.8⚠ KEVPL ✓same vendor
XWiki Platform — niezautoryzowany RCE przez endpoint SolrSearch