Patchfirst
Patchfirst
CVE-2025-32969 Public exploit Critical · 9.3 EPSS 80.0%

org.xwiki.platform:xwiki-platform-rest-server allows SQL injection in query endpoint of REST API

xwiki · xwiki-platform

Summary

A SQL injection flaw in the query endpoint of the REST API in XWiki's xwiki-platform (the xwiki-platform-rest-server component) lets an attacker escape the HQL execution context and reach the database backend. An unauthenticated remote attacker can exploit it without user interaction, using a blind SQL injection that can read data such as password hashes and, depending on the database, run UPDATE, INSERT, or DELETE statements, even when the options preventing unregistered users from viewing or editing pages are enabled.

Official description · CVE.org

XWiki is a generic wiki platform. In versions starting from 1.8 and prior to 15.10.16, 16.4.6, and 16.10.1, it is possible for a remote unauthenticated user to escape from the HQL execution context and perform a blind SQL injection to execute arbitrary SQL statements on the database backend, including when "Prevent unregistered users from viewing pages, regardless of the page rights" and "Prevent unregistered users from editing pages, regardless of the page rights" options are enabled. Depending on the used database backend, the attacker may be able to not only obtain confidential information such as password hashes from the database, but also execute UPDATE/INSERT/DELETE queries. This issue has been patched in versions 16.10.1, 16.4.6 and 15.10.16. There is no known workaround, other than upgrading XWiki.

Breakdown
66.4 / 100
Exploited
Yes, in VulnCheck KEV
Reports
0
Tactics
0/15

First seen exploited 4 months after disclosure.

  1. Disclosedday 0
  2. First seen exploitedVulnCheck KEV evidence+4 mo

7 fixes in xwiki-platform-rest-server over 15 months. The latest fix listed for xwiki-platform-rest-server is 17.7.0-rc-1.

Fixes in xwiki-platform-rest-serverMaven package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

  1. 16.3.0-rc-1CVE-2024-4559110 Sep 2024
  2. 16.7.0CVE-2025-4655430 Apr 2025
  3. 16.10.0-rc-1CVE-2025-2992519 Mar 2025
  4. 16.10.1CVE-2025-3296923 Apr 2025
  5. 17.0.0CVE-2025-4958413 Jun 2025
  6. 17.4.2CVE-2025-524726 Oct 2025
  7. 17.7.0-rc-1CVE-2025-6647310 Dec 2025Latest listed

techniques

No techniques linked

No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

1 package in 1 ecosystem. Main package: org.xwiki.platform:xwiki-platform-rest-server.

Mavenorg.xwiki.platform:xwiki-platform-rest-serverGHSA-f69v-xrj8-rhxf

Upgrade to 16.10.9 or later

Fixes this CVE and 3 other known vulnerabilities in this package (CVE-2025-29925, CVE-2025-46554, +1).

Set the version to 16.10.9 or later in your pom.xml or build.gradle.

First fixed in 16.10.1 for CVE-2025-32969.

Affected versions, by release line

If you runUpgrade to
16.5.0-rc-1 up to 16.10.116.10.9first fix for this CVE: 16.10.1
16.0.0-rc-1 up to 16.4.6

Still affected on this line by CVE-2025-52472 (fixed in 16.10.9, a newer line).

16.4.6
1.8 up to 15.10.16

Still affected on this line by CVE-2025-52472 (fixed in 16.10.9, a newer line).

15.10.16

“Up to” means the second version is the fix and is not affected.

Check your lockfile against all CVEs

What security researchers reported

Not named in any threat report yet

References

3 links, grouped by NVD tag

x_refsource_CONFIRM 1

github.com/xwiki/xwiki-platform/security/advisories/GHSA-f69v-xrj8-rhxf

x_refsource_MISC 2

github.com/xwiki/xwiki-platform/commit/5c11a874bd24a581f534d283186e209bbccd8113jira.xwiki.org/browse/XWIKI-22691
↑ ↓ chooseEnter openEsc close