CVE-2025-32969
- Source
- https://cve.org/CVERecord?id=CVE-2025-32969
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-32969.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2025-32969
- Aliases
- Published
- 2025-04-23T15:33:03.732Z
- Modified
- 2026-07-22T04:01:52.419031Z
- Severity
-
- 9.3 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- org.xwiki.platform:xwiki-platform-rest-server allows SQL injection in query endpoint of REST API
- Details
-
XWiki is a generic wiki platform. In versions starting from 1.8 and prior to 15.10.16, 16.4.6, and 16.10.1, it is possible for a remote unauthenticated user to escape from the HQL execution context and perform a blind SQL injection to execute arbitrary SQL statements on the database backend, including when "Prevent unregistered users from viewing pages, regardless of the page rights" and "Prevent unregistered users from editing pages, regardless of the page rights" options are enabled. Depending on the used database backend, the attacker may be able to not only obtain confidential information such as password hashes from the database, but also execute UPDATE/INSERT/DELETE queries. This issue has been patched in versions 16.10.1, 16.4.6 and 15.10.16. There is no known workaround, other than upgrading XWiki.
- Database specific
{ "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/32xxx/CVE-2025-32969.json", "cna_assigner": "GitHub_M", "cwe_ids": [ "CWE-89" ] }- References
-
- https://jira.xwiki.org/browse/XWIKI-22691
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/32xxx/CVE-2025-32969.json
- https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-f69v-xrj8-rhxf
- https://nvd.nist.gov/vuln/detail/CVE-2025-32969
- https://github.com/xwiki/xwiki-platform/commit/5c11a874bd24a581f534d283186e209bbccd8113
Affected packages
Git / github.com/xwiki/xwiki-commons
Affected ranges
- Type
- GIT
- Repo
- https://github.com/xwiki/xwiki-commons
- Events
- Database specific
{ "source": "CPE_RANGE", "extracted_events": [ { "introduced": "1.8" }, { "fixed": "15.10.16" }, { "introduced": "16.0.0" }, { "fixed": "16.4.6" }, { "introduced": "16.5.0" }, { "fixed": "16.10.1" } ], "cpe": "cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*" }
- Type
- GIT
- Repo
- https://github.com/xwiki/xwiki-platform
- Events
-
IntroducedFixedIntroducedFixedIntroducedFixedFixed
- Database specific
{ "source": [ "CPE_RANGE", "REFERENCES" ], "extracted_events": [ { "introduced": "1.8" }, { "fixed": "15.10.16" }, { "introduced": "16.0.0" }, { "fixed": "16.4.6" }, { "introduced": "16.5.0" }, { "fixed": "16.10.1" } ], "cpe": "cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*" }
Database specific
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-32969.json"
vanir_signatures_modified
"2026-07-22T04:01:52Z"
vanir_signatures
[
{
"target": {
"file": "xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/store/hibernate/query/HqlQueryExecutor.java",
"function": "execute"
},
"deprecated": false,
"signature_type": "Function",
"id": "CVE-2025-32969-09d89a30",
"signature_version": "v1",
"source": "https://github.com/xwiki/xwiki-platform/commit/5c11a874bd24a581f534d283186e209bbccd8113",
"digest": {
"function_hash": "71915635600221943123647699532298182706",
"length": 711.0
}
},
{
"target": {
"file": "xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/store/hibernate/query/HqlQueryExecutor.java",
"function": "isSafeSelect"
},
"deprecated": false,
"signature_type": "Function",
"id": "CVE-2025-32969-1195f631",
"signature_version": "v1",
"source": "https://github.com/xwiki/xwiki-platform/commit/5c11a874bd24a581f534d283186e209bbccd8113",
"digest": {
"function_hash": "306395792679406814640629565748200668800",
"length": 116.0
}
},
{
"target": {
"file": "xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/store/hibernate/query/HqlQueryExecutor.java",
"function": "completeShortFormStatement"
},
"deprecated": false,
"signature_type": "Function",
"id": "CVE-2025-32969-3fa61234",
"signature_version": "v1",
"source": "https://github.com/xwiki/xwiki-platform/commit/5c11a874bd24a581f534d283186e209bbccd8113",
"digest": {
"function_hash": "233922180488403057442915999890019646400",
"length": 298.0
}
},
{
"target": {
"file": "xwiki-platform-core/xwiki-platform-oldcore/src/test/java/com/xpn/xwiki/store/hibernate/query/HqlQueryExecutorTest.java",
"function": "executeDeleteWithoutProgrammingRight"
},
"deprecated": false,
"signature_type": "Function",
"id": "CVE-2025-32969-49b68d81",
"signature_version": "v1",
"source": "https://github.com/xwiki/xwiki-platform/commit/5c11a874bd24a581f534d283186e209bbccd8113",
"digest": {
"function_hash": "107409280835079837727752034686034924136",
"length": 331.0
}
},
{
"target": {
"file": "xwiki-platform-core/xwiki-platform-oldcore/src/test/java/com/xpn/xwiki/store/hibernate/query/HqlQueryExecutorTest.java",
"function": "executeNamedQueryWithoutProgrammingRight"
},
"deprecated": false,
"signature_type": "Function",
"id": "CVE-2025-32969-620fbbbf",
"signature_version": "v1",
"source": "https://github.com/xwiki/xwiki-platform/commit/5c11a874bd24a581f534d283186e209bbccd8113",
"digest": {
"function_hash": "294377677331894544418678194371021021646",
"length": 283.0
}
},
{
"target": {
"file": "xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/store/hibernate/query/HqlQueryExecutor.java"
},
"deprecated": false,
"signature_type": "Line",
"id": "CVE-2025-32969-70287893",
"signature_version": "v1",
"source": "https://github.com/xwiki/xwiki-platform/commit/5c11a874bd24a581f534d283186e209bbccd8113",
"digest": {
"line_hashes": [
"29764526124369944672324866449783540557",
"179711466439194561300222319680867299661",
"127633609887690088571545857944868738808",
"40455291728265088513713268511348506851",
"85744672462029274063092310089594662476",
"236176168300607007479217637185041643181",
"264453146272680758401820548567445256421",
"338031168609902461399610544616053548713",
"340261382256231532222641352929139775198",
"138821291300670567233780494264446854989",
"275438346186718507494470713953503739760",
"296669765919584294326497711199856380416",
"82283445128147193112646224029479066069",
"311148889890884416236194322277632515653",
"116534222086187315656958438108381145616",
"76822058297070574824722918268058409069",
"330765008690800222872980223424753466789",
"263171266468059606015495646536831250124",
"46981383010789327379516600524657099279",
"113721258553452847839540818339737019977",
"139444525181225832612645452873598015917",
"64864685424462812772007918145889806613",
"314139688933855665279390545945856987676",
"12822071480228796020052852926827852163",
"174283424488504624758079841244797273768",
"227352637001080134736640261704886962892"
],
"threshold": 0.9
}
},
{
"target": {
"file": "xwiki-platform-core/xwiki-platform-oldcore/src/test/java/com/xpn/xwiki/store/hibernate/query/HqlQueryExecutorTest.java"
},
"deprecated": false,
"signature_type": "Line",
"id": "CVE-2025-32969-747d7c00",
"signature_version": "v1",
"source": "https://github.com/xwiki/xwiki-platform/commit/5c11a874bd24a581f534d283186e209bbccd8113",
"digest": {
"line_hashes": [
"219851029763773319196868600970018094035",
"261544324917813846515875472916004452811",
"230315282388757225184550174926154351509",
"260331074652396965332409437517175704487",
"219218616056967809266041797383852728122",
"8110875020460993032167425669953606240",
"280090052601423837829575180727896177091",
"193061006595212668909962490204220757723",
"134916061914545865124974168043990710258",
"330079849680996336044395542940998535455",
"226209220190226958366234723348656411935",
"193061006595212668909962490204220757723",
"180704923359856214733066600562975004259",
"323474709890049761797079909414095126237",
"43191054265259561442640258098246435605",
"41537157746836183514445801741080293043",
"165016736940197089901134590890488391244",
"101588323801411939059739276987034374365",
"296812791529938736014707118618517735933",
"77132510386940289335568073180119567752"
],
"threshold": 0.9
}
},
{
"target": {
"file": "xwiki-platform-core/xwiki-platform-oldcore/src/test/java/com/xpn/xwiki/internal/store/hibernate/query/HqlQueryUtilsTest.java",
"function": "isSafe"
},
"deprecated": false,
"signature_type": "Function",
"id": "CVE-2025-32969-7b381682",
"signature_version": "v1",
"source": "https://github.com/xwiki/xwiki-platform/commit/5c11a874bd24a581f534d283186e209bbccd8113",
"digest": {
"function_hash": "229987505567189240458760747389754293208",
"length": 1748.0
}
},
{
"target": {
"file": "xwiki-platform-core/xwiki-platform-oldcore/src/test/java/com/xpn/xwiki/internal/store/hibernate/query/HqlQueryUtilsTest.java"
},
"deprecated": false,
"signature_type": "Line",
"id": "CVE-2025-32969-8122b6ea",
"signature_version": "v1",
"source": "https://github.com/xwiki/xwiki-platform/commit/5c11a874bd24a581f534d283186e209bbccd8113",
"digest": {
"line_hashes": [
"125654086155492223015484826810588147386",
"30364311566075007780491846591882008021",
"8344953984289394105758456829646653205",
"101857731986020391442691056316455449076"
],
"threshold": 0.9
}
},
{
"target": {
"file": "xwiki-platform-core/xwiki-platform-oldcore/src/test/java/com/xpn/xwiki/store/hibernate/query/HqlQueryExecutorTest.java",
"function": "executeUpdateWithoutProgrammingRight"
},
"deprecated": false,
"signature_type": "Function",
"id": "CVE-2025-32969-b3ee5d73",
"signature_version": "v1",
"source": "https://github.com/xwiki/xwiki-platform/commit/5c11a874bd24a581f534d283186e209bbccd8113",
"digest": {
"function_hash": "215233641137331323629783887372883594653",
"length": 339.0
}
},
{
"target": {
"file": "xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/store/hibernate/query/HqlQueryExecutor.java",
"function": "checkAllowed"
},
"deprecated": false,
"signature_type": "Function",
"id": "CVE-2025-32969-bf51425b",
"signature_version": "v1",
"source": "https://github.com/xwiki/xwiki-platform/commit/5c11a874bd24a581f534d283186e209bbccd8113",
"digest": {
"function_hash": "121575240036273865284335149093372902448",
"length": 488.0
}
},
{
"target": {
"file": "xwiki-platform-core/xwiki-platform-oldcore/src/test/java/com/xpn/xwiki/store/hibernate/query/HqlQueryExecutorTest.java",
"function": "executeWhenNotAllowedSelect"
},
"deprecated": false,
"signature_type": "Function",
"id": "CVE-2025-32969-c55872dc",
"signature_version": "v1",
"source": "https://github.com/xwiki/xwiki-platform/commit/5c11a874bd24a581f534d283186e209bbccd8113",
"digest": {
"function_hash": "20393380694833077298953439474497577440",
"length": 380.0
}
},
{
"target": {
"file": "xwiki-platform-core/xwiki-platform-rest/xwiki-platform-rest-server/src/main/java/org/xwiki/rest/internal/resources/search/AbstractDatabaseSearchSource.java"
},
"deprecated": false,
"signature_type": "Line",
"id": "CVE-2025-32969-d6c548d7",
"signature_version": "v1",
"source": "https://github.com/xwiki/xwiki-platform/commit/5c11a874bd24a581f534d283186e209bbccd8113",
"digest": {
"line_hashes": [
"44124520486397976206307052806192627580",
"251445392816854700740684931045063151111",
"253488817032808963984866237992168049653",
"204521460034917831617833961954806782725"
],
"threshold": 0.9
}
}
]