CVE-2025-52472

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2025-52472

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-52472.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2025-52472

Aliases

GHSA-gprp-h92g-gc2h

Published

2025-10-06T14:53:46.654Z

Modified

2026-07-22T04:02:12.159961Z

Severity

9.3 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

XWiki Platform vulnerable to HQL injection via wiki and space search REST API

Details

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting in version 4.3-milestone-1 and prior to versions 16.10.9, 17.4.2, and 17.5.0, the REST search URL is vulnerable to HQL injection via the orderField parameter. The specified value is added twice in the query, though, once in the field list for the select and once in the order clause, so it's not that easy to exploit. The part of the query between the two fields can be enclosed in single quotes to effectively remove them, but the query still needs to remain valid with the query two times in it. This has been patched in versions 17.5.0, 17.4.2, and 16.10.9. No known workarounds are available.

Database specific

{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-89"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/52xxx/CVE-2025-52472.json"
}

References

Affected packages

Git / github.com/xwiki/xwiki-platform

Affected ranges

Type

GIT

Repo

https://github.com/xwiki/xwiki-platform

Events

Introduced

7878213ba6bd4b007e9277d45ef79c48c0cec49a

Introduced

445c0831fb8cf5610eda0eb58225890cb2bece6c

Fixed

89e08a6422ec7342c35bfc21191228e2f7f56857

Fixed

55ef6325bb07177d283e8e84040a6c65afebb3d7

Fixed

743ebf8696ffa55161ed2c5ecf26b09f69e6bcf1

Fixed

a45eca2af772abb7324e56d7fd2df1ac937bc445

Database specific

{
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "4.3-milestone-1"
        },
        {
            "fixed": "16.10.9"
        },
        {
            "introduced": "17.0.0-rc-1"
        },
        {
            "fixed": "17.4.2"
        }
    ]
}

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-52472.json"

vanir_signatures_modified

"2026-07-22T04:02:12Z"

vanir_signatures

[
    {
        "signature_version": "v1",
        "source": "https://github.com/xwiki/xwiki-platform/commit/a45eca2af772abb7324e56d7fd2df1ac937bc445",
        "deprecated": false,
        "signature_type": "Line",
        "id": "CVE-2025-52472-06542d5d",
        "digest": {
            "line_hashes": [
                "264920635722433320133552762591873246650",
                "80537248098748631403944970527953331542",
                "319380091291869020510407555426524862674",
                "181848877384094212643225860986683055705",
                "45441990640926916743572792384914356183",
                "14736804285077465713650473725539388714",
                "234549238805963729313685674125638946438",
                "25794196493261016625011867141587813117",
                "223758039110397874430155733434709628244",
                "692428865844126647790648284035792553",
                "204148930945372256723436607441889134896",
                "262380785711392389557203436990745914228",
                "65565153437458595739942731354590916271",
                "22958578442243531962362762892175876195",
                "65503075251055410117493377822056147527",
                "139396658654974828471002578599176464485",
                "154640207775498548024044896389411303799",
                "90312832907197036325003741221469717473",
                "120240245966897389172444991452196711248",
                "191362421938506867301943657124023248915",
                "206297489438265837482860698758865486872",
                "46410138842189941277984084602803314090",
                "116126647620274954819432460698906515018",
                "93438689198933332865915760417990622373",
                "50592886237023727818890183548720529492",
                "295873801671941193597656014919801331941",
                "97506276474378517093811690899054049473",
                "152635011530328619314993449798179374583",
                "21977810126915343580085459413328751953",
                "324426580821461224801407870073651681942",
                "174998228877367817262886656120257597487",
                "332714805792767609741806390480093310459",
                "257746912595987454139820631833667056073",
                "153144173284136118639086229255995861642",
                "34888003866186506004160388639146776948",
                "308026477114750199283281138322805764226",
                "307820475749681798839093346421635527869",
                "288260030843436781287540464335493245949",
                "220043821622757854609572073018834497563",
                "192578687462616356268049338811549764595",
                "224994587617482437911989284405544447663",
                "338907767421543491186175760097742588913",
                "245616479817156637031160638361718851621",
                "182824121816189884626254288072370418036",
                "56905828007814316240752173182029863096",
                "107786009127378288506961976784459789529",
                "156752097644980870877288299406924818881",
                "273948663365191829155286754985133681311",
                "261592551563546098967165769319949201277",
                "151673642331173305914615364666428650226",
                "120850888849952890455103432515791484779",
                "190388661033358017214328575585811383456",
                "339673720495377480127212864375051424308",
                "51862940258172605478673171968886979248",
                "45403260454616265575939768871028031844",
                "149903482342506425487253421427414796975",
                "103113473310493686588210787028751306820",
                "249813950221112818369402047268892041319",
                "135366718334470453251611487916728866052",
                "287852538712436888248338417203565343953",
                "313164174066840118160637072405908505451",
                "72630291246401356365988324912374904987",
                "148872605416502202557676282649824038466",
                "269923104648120560882238078698186264260",
                "57117156968525706699145942284682615717",
                "152480120388072130647673095941423602035",
                "148067041947607650438493501852300436154",
                "172207821300399454662143048920240942752",
                "333000436044511588452193685936362754255",
                "226227912482698819222431076032127186482",
                "38989453997043454722720767424514813146",
                "219065376701920986017955086253794109843",
                "118986775274177289212309797931025001751",
                "154765778738460058227150953686946468151",
                "174991898458253729382268058603560672963",
                "314657006388322625729229949422124371453",
                "246445044317443265575493287017935180138",
                "187403903609325268564935057607660474058",
                "73213127227391591457035409257308948500",
                "6507316235013739413475964428002160412",
                "75857287841752936126770430879939391842",
                "336226197542980174774031337831299236354",
                "6400394938051170862457182433402827086",
                "178655520166164814557012685452422764479",
                "149749712184433598071414622236251123738",
                "137203744155922643049464484975058188774",
                "270645045223390782002385803932778411461",
                "23985079890832904274722494141408361530",
                "104500353713444735242738446886648703400",
                "99478374656168102354960579328462917824",
                "48599132862103161538091376868697352023",
                "114867002289548924261354250312865621773",
                "239323627209346689492230673843879889211",
                "180964380257343871496671485210271934534",
                "186485859913084141340146803400062791629",
                "295691611295920283789842270425815388821",
                "318227347882123729440245797281943732207",
                "74377679625164431906331701220884923828",
                "88918475289151013510842503560143723044",
                "240477671510446148808236870068923946852",
                "319805125292910323437779427930889821880",
                "301958838443573132132495061147355065770",
                "234298235946473769488031396218781764870",
                "222684145340529424615188001161438682629",
                "221074804314499817440771220878883810082"
            ],
            "threshold": 0.9
        },
        "target": {
            "file": "xwiki-platform-core/xwiki-platform-rest/xwiki-platform-rest-server/src/main/java/org/xwiki/rest/internal/resources/DatabaseKeywordSearchSource.java"
        }
    },
    {
        "signature_version": "v1",
        "source": "https://github.com/xwiki/xwiki-platform/commit/743ebf8696ffa55161ed2c5ecf26b09f69e6bcf1",
        "deprecated": false,
        "signature_type": "Line",
        "id": "CVE-2025-52472-2dabb466",
        "digest": {
            "line_hashes": [
                "326052865136351706143782901429062543774",
                "106590621291578375619974261272417014850",
                "280147270115297494386334734711055663348",
                "231414046054836698383737718609057730156",
                "207176098971761150937219659867631023334",
                "169613615864736643837360775492444664845"
            ],
            "threshold": 0.9
        },
        "target": {
            "file": "xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/internal/store/hibernate/query/HqlQueryUtils.java"
        }
    },
    {
        "signature_version": "v1",
        "source": "https://github.com/xwiki/xwiki-platform/commit/743ebf8696ffa55161ed2c5ecf26b09f69e6bcf1",
        "deprecated": false,
        "signature_type": "Function",
        "id": "CVE-2025-52472-335b5a90",
        "digest": {
            "length": 3597.0,
            "function_hash": "242152692312857272947914616896484999917"
        },
        "target": {
            "file": "xwiki-platform-core/xwiki-platform-rest/xwiki-platform-rest-server/src/main/java/org/xwiki/rest/internal/resources/BaseSearchResult.java",
            "function": "searchPages"
        }
    },
    {
        "signature_version": "v1",
        "source": "https://github.com/xwiki/xwiki-platform/commit/743ebf8696ffa55161ed2c5ecf26b09f69e6bcf1",
        "deprecated": false,
        "signature_type": "Function",
        "id": "CVE-2025-52472-37ce0b55",
        "digest": {
            "length": 1582.0,
            "function_hash": "136517032982876107244724943897611808654"
        },
        "target": {
            "file": "xwiki-platform-core/xwiki-platform-rest/xwiki-platform-rest-server/src/main/java/org/xwiki/rest/internal/resources/ModificationsResourceImpl.java",
            "function": "getModifications"
        }
    },
    {
        "signature_version": "v1",
        "source": "https://github.com/xwiki/xwiki-platform/commit/743ebf8696ffa55161ed2c5ecf26b09f69e6bcf1",
        "deprecated": false,
        "signature_type": "Function",
        "id": "CVE-2025-52472-3f4b43e3",
        "digest": {
            "length": 1617.0,
            "function_hash": "48538038570594063984222434951371791747"
        },
        "target": {
            "file": "xwiki-platform-core/xwiki-platform-rest/xwiki-platform-rest-server/src/main/java/org/xwiki/rest/internal/resources/pages/PageHistoryResourceImpl.java",
            "function": "getPageHistory"
        }
    },
    {
        "signature_version": "v1",
        "source": "https://github.com/xwiki/xwiki-platform/commit/a45eca2af772abb7324e56d7fd2df1ac937bc445",
        "deprecated": false,
        "signature_type": "Function",
        "id": "CVE-2025-52472-54850268",
        "digest": {
            "length": 3743.0,
            "function_hash": "247119896938518901176331948353635740769"
        },
        "target": {
            "file": "xwiki-platform-core/xwiki-platform-rest/xwiki-platform-rest-server/src/main/java/org/xwiki/rest/internal/resources/DatabaseKeywordSearchSource.java",
            "function": "searchPages"
        }
    },
    {
        "signature_version": "v1",
        "source": "https://github.com/xwiki/xwiki-platform/commit/743ebf8696ffa55161ed2c5ecf26b09f69e6bcf1",
        "deprecated": false,
        "signature_type": "Function",
        "id": "CVE-2025-52472-616f9b58",
        "digest": {
            "length": 2003.0,
            "function_hash": "302623309605434049496550760961071150783"
        },
        "target": {
            "file": "xwiki-platform-core/xwiki-platform-rest/xwiki-platform-rest-server/src/main/java/org/xwiki/rest/internal/resources/BaseSearchResult.java",
            "function": "searchSpaces"
        }
    },
    {
        "signature_version": "v1",
        "source": "https://github.com/xwiki/xwiki-platform/commit/743ebf8696ffa55161ed2c5ecf26b09f69e6bcf1",
        "deprecated": false,
        "signature_type": "Line",
        "id": "CVE-2025-52472-7038ad53",
        "digest": {
            "line_hashes": [
                "252826264824883907233398551446172943862",
                "76797886069042444502250430291440294349",
                "298460319954706893006033878020874355776",
                "339643526976016218961740471746465166707",
                "37372641083463720326802299230886375562",
                "143035982150812674096589614636371216924",
                "238292641862317192684234299976224633294",
                "219808633817237785922607830557687641089",
                "284124927035003376720261158490206723295",
                "158877461279125668274276275397696221747",
                "261724216163187150147998066113655015163",
                "55194411012088439647314992540688451454",
                "338963232776060325112420347480915175335",
                "299058182586915936215317935631265386887",
                "125394458266901593286552386437241020828"
            ],
            "threshold": 0.9
        },
        "target": {
            "file": "xwiki-platform-core/xwiki-platform-rest/xwiki-platform-rest-server/src/main/java/org/xwiki/rest/internal/resources/pages/PageHistoryResourceImpl.java"
        }
    },
    {
        "signature_version": "v1",
        "source": "https://github.com/xwiki/xwiki-platform/commit/a45eca2af772abb7324e56d7fd2df1ac937bc445",
        "deprecated": false,
        "signature_type": "Function",
        "id": "CVE-2025-52472-769cffb8",
        "digest": {
            "length": 4439.0,
            "function_hash": "125794265429449060712053009720402726956"
        },
        "target": {
            "file": "xwiki-platform-core/xwiki-platform-rest/xwiki-platform-rest-server/src/main/java/org/xwiki/rest/internal/resources/DatabaseKeywordSearchSource.java",
            "function": "searchObjects"
        }
    },
    {
        "signature_version": "v1",
        "source": "https://github.com/xwiki/xwiki-platform/commit/743ebf8696ffa55161ed2c5ecf26b09f69e6bcf1",
        "deprecated": false,
        "signature_type": "Line",
        "id": "CVE-2025-52472-809595ae",
        "digest": {
            "line_hashes": [
                "145654739288050706942662072765713528672",
                "285030461548567026604808722358744072941",
                "293814432303826312709442542996074077424",
                "35824459017490090658221918094000682860",
                "237093145677797027856546027452254582208",
                "74411589827854720413635573719791824100",
                "118163282256722720256575381396545244062",
                "30792310034949383633050726160348551704",
                "130960610064108899959865016721285752962",
                "337415798766324628136319039919040501862",
                "321602622501092769195799755477351772482",
                "108967483519301944111119593084181213037",
                "205392076029341687174987812521050732345",
                "126910148403427867992603711632368041477",
                "65957215547867062559494358607932644798",
                "156551181748254963988068773475997131452"
            ],
            "threshold": 0.9
        },
        "target": {
            "file": "xwiki-platform-core/xwiki-platform-rest/xwiki-platform-rest-server/src/main/java/org/xwiki/rest/internal/resources/ModificationsResourceImpl.java"
        }
    },
    {
        "signature_version": "v1",
        "source": "https://github.com/xwiki/xwiki-platform/commit/743ebf8696ffa55161ed2c5ecf26b09f69e6bcf1",
        "deprecated": false,
        "signature_type": "Line",
        "id": "CVE-2025-52472-ade77dea",
        "digest": {
            "line_hashes": [
                "273547942328633240286958196764587505478",
                "329562472672400908197750863438685577233",
                "59331844118749747807612969203710291167"
            ],
            "threshold": 0.9
        },
        "target": {
            "file": "xwiki-platform-core/xwiki-platform-oldcore/src/test/java/com/xpn/xwiki/internal/store/hibernate/query/HqlQueryUtilsTest.java"
        }
    },
    {
        "signature_version": "v1",
        "source": "https://github.com/xwiki/xwiki-platform/commit/743ebf8696ffa55161ed2c5ecf26b09f69e6bcf1",
        "deprecated": false,
        "signature_type": "Line",
        "id": "CVE-2025-52472-bf7c10c9",
        "digest": {
            "line_hashes": [
                "144188365585769347203025183513568799665",
                "252159589656453482770058081140073791761",
                "170468112777249449947492782960924973022",
                "166431518617959865043893352237553722791",
                "214368953266204362436857460550789057189",
                "132068160425887172256320919334033459721",
                "163110488500362902004829747943767406554",
                "257404444557232819028515112604971009230",
                "64730639906637401113303401275063185781",
                "330522394070916264622308591193318033614",
                "257230364375598917538443873366453029413",
                "135183996447927290968463433018482986781",
                "157512327171057264921571672392025573677",
                "211656419494036948663174084638082609612",
                "7832367563393252267346293348348669750",
                "303019511750258456446260480133745501333",
                "288260030843436781287540464335493245949",
                "325460116762300091477427613010173455627",
                "311743395002760211604822094300168800496",
                "99745616673093922686945440186701165293",
                "104153742434066695406053686105814908148",
                "201775018331089882885395836121917057988",
                "17727856562878349172921659806479920216",
                "217147942337445504469096178438883536508",
                "237601975796333632788572092826499797508",
                "79268050821931996630058633175410939770",
                "323407916759372770328719893573848072491",
                "265418196771415589094680864217546532611",
                "235163713530234892108392576739453938030",
                "207732878446346741656094073496833428501",
                "202204874765728602177044825884421208354",
                "316359549065716478103357452933742551604",
                "161900730336528258507832738251038529534",
                "116496948465821326797103504735327877497",
                "197461986933032262202880418822749192350",
                "200049312125518010852117813359058796572"
            ],
            "threshold": 0.9
        },
        "target": {
            "file": "xwiki-platform-core/xwiki-platform-rest/xwiki-platform-rest-server/src/main/java/org/xwiki/rest/internal/resources/BaseSearchResult.java"
        }
    },
    {
        "signature_version": "v1",
        "source": "https://github.com/xwiki/xwiki-platform/commit/743ebf8696ffa55161ed2c5ecf26b09f69e6bcf1",
        "deprecated": false,
        "signature_type": "Function",
        "id": "CVE-2025-52472-c55f466e",
        "digest": {
            "length": 1647.0,
            "function_hash": "112355271989940582121407205731524741000"
        },
        "target": {
            "file": "xwiki-platform-core/xwiki-platform-rest/xwiki-platform-rest-server/src/main/java/org/xwiki/rest/internal/resources/pages/PageTranslationHistoryResourceImpl.java",
            "function": "getPageTranslationHistory"
        }
    },
    {
        "signature_version": "v1",
        "source": "https://github.com/xwiki/xwiki-platform/commit/743ebf8696ffa55161ed2c5ecf26b09f69e6bcf1",
        "deprecated": false,
        "signature_type": "Line",
        "id": "CVE-2025-52472-f1ac2f2a",
        "digest": {
            "line_hashes": [
                "252826264824883907233398551446172943862",
                "76797886069042444502250430291440294349",
                "42655264695799129810937552959561144661",
                "301542881701738595073808987362875299717",
                "37372641083463720326802299230886375562",
                "143035982150812674096589614636371216924",
                "238292641862317192684234299976224633294",
                "128148230612815006998365531558287584828",
                "12647313212845909747775429393109085634",
                "45752665035291201843176664410636911013",
                "44459539141704066905950633599214514900",
                "224383897938920690641452519244131112345",
                "49327342227712975697793421485138276027",
                "50604894349574259673229014555712914617",
                "336451594322654946274460727561910148717",
                "113229274926572965248256080813166877649"
            ],
            "threshold": 0.9
        },
        "target": {
            "file": "xwiki-platform-core/xwiki-platform-rest/xwiki-platform-rest-server/src/main/java/org/xwiki/rest/internal/resources/pages/PageTranslationHistoryResourceImpl.java"
        }
    },
    {
        "signature_version": "v1",
        "source": "https://github.com/xwiki/xwiki-platform/commit/a45eca2af772abb7324e56d7fd2df1ac937bc445",
        "deprecated": false,
        "signature_type": "Function",
        "id": "CVE-2025-52472-f47b9be7",
        "digest": {
            "length": 2061.0,
            "function_hash": "271225538941836230999945804976951223786"
        },
        "target": {
            "file": "xwiki-platform-core/xwiki-platform-rest/xwiki-platform-rest-server/src/main/java/org/xwiki/rest/internal/resources/DatabaseKeywordSearchSource.java",
            "function": "searchSpaces"
        }
    },
    {
        "signature_version": "v1",
        "source": "https://github.com/xwiki/xwiki-platform/commit/743ebf8696ffa55161ed2c5ecf26b09f69e6bcf1",
        "deprecated": false,
        "signature_type": "Function",
        "id": "CVE-2025-52472-f9c379c4",
        "digest": {
            "length": 4223.0,
            "function_hash": "135308866872992691185567177640752557139"
        },
        "target": {
            "file": "xwiki-platform-core/xwiki-platform-rest/xwiki-platform-rest-server/src/main/java/org/xwiki/rest/internal/resources/BaseSearchResult.java",
            "function": "searchObjects"
        }
    }
]