{"id":"CVE-2025-32429","summary":"XWiki Platform vulnerable to SQL injection through getdeleteddocuments.vm template sort parameter","details":"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions 9.4-rc-1 through 16.10.5 and 17.0.0-rc-1 through 17.2.2, it's possible for anyone to inject SQL using the parameter sort of the getdeleteddocuments.vm. It's injected as is as an ORDER BY value. This is fixed in versions 16.10.6 and 17.3.0-rc-1.","aliases":["GHSA-vr59-gm53-v7cq"],"modified":"2026-08-12T14:52:36.540993Z","published":"2025-07-24T22:22:35.102Z","database_specific":{"cwe_ids":["CWE-89"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/32xxx/CVE-2025-32429.json","cna_assigner":"GitHub_M"},"references":[{"type":"WEB","url":"https://jira.xwiki.org/browse/XWIKI-23093"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/32xxx/CVE-2025-32429.json"},{"type":"ADVISORY","url":"https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-vr59-gm53-v7cq"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-32429"},{"type":"FIX","url":"https://github.com/xwiki/xwiki-platform/commit/dfd0744e9c18d24ac66a0d261dc6cafd1c209101"},{"type":"FIX","url":"https://github.com/xwiki/xwiki-platform/commit/f502b5d5fd36284a50890ad26d168b7d8dc80bd3"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/xwiki/xwiki-commons","events":[{"introduced":"5d9b843b53012bd07504f3caa092afc2379314e6"},{"fixed":"ea21b6389eb2aeb9660ef5bc0bc38beeac372c9e"},{"introduced":"e84d9bd1b4c0c8219597e10acfd8fbd692416294"},{"last_affected":"92d3468f1c4a24e16ee826e4be5eb6e7cb62474a"}],"database_specific":{"cpe":"cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"9.4"},{"fixed":"16.10.6"},{"introduced":"17.0.0"},{"last_affected":"17.2.2"}],"source":"CPE_RANGE"}},{"type":"GIT","repo":"https://github.com/xwiki/xwiki-platform","events":[{"introduced":"8e3eba25af152f00028e5daedda783114e4d8680"},{"fixed":"0708ca6ba734c6d79984d887b9afa11d7255d1a0"},{"introduced":"7edb5b7d98170ec081c7e30237971d7dfb8a4401"},{"fixed":"dfd0744e9c18d24ac66a0d261dc6cafd1c209101"},{"fixed":"f502b5d5fd36284a50890ad26d168b7d8dc80bd3"}],"database_specific":{"cpe":"cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"9.4"},{"fixed":"16.10.6"},{"introduced":"17.0.0"},{"last_affected":"17.2.2"}],"source":["CPE_RANGE","REFERENCES"]}}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-32429.json","vanir_signatures_modified":"2026-08-12T14:52:36Z","vanir_signatures":[{"source":"https://github.com/xwiki/xwiki-platform/commit/f502b5d5fd36284a50890ad26d168b7d8dc80bd3","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/org/xwiki/query/hql/internal/DefaultHQLStatementValidator.java","function":"checkOrderBySafe"},"deprecated":false,"digest":{"function_hash":"103256926916921333354728244922514016711","length":446},"id":"CVE-2025-32429-80e78f2e","signature_type":"Function","signature_version":"v1"},{"source":"https://github.com/xwiki/xwiki-platform/commit/f502b5d5fd36284a50890ad26d168b7d8dc80bd3","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/org/xwiki/query/hql/internal/DefaultHQLStatementValidator.java"},"deprecated":false,"digest":{"line_hashes":["216575233326256981786961415228802532242","265159667122621027536592135804183150038","231904646144242751361284637481877772401","276183770325985981030748634941463723738"],"threshold":0.9},"id":"CVE-2025-32429-bea32ae2","signature_type":"Line","signature_version":"v1"},{"target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/org/xwiki/query/hql/internal/DefaultHQLStatementValidator.java","function":"checkOrderBySafe"},"deprecated":false,"digest":{"length":446,"function_hash":"103256926916921333354728244922514016711"},"id":"CVE-2025-32429-f2537e3f","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/dfd0744e9c18d24ac66a0d261dc6cafd1c209101"},{"target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/org/xwiki/query/hql/internal/DefaultHQLStatementValidator.java"},"deprecated":false,"digest":{"line_hashes":["216575233326256981786961415228802532242","265159667122621027536592135804183150038","231904646144242751361284637481877772401","276183770325985981030748634941463723738"],"threshold":0.9},"id":"CVE-2025-32429-fa86eb1d","signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/dfd0744e9c18d24ac66a0d261dc6cafd1c209101"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}]}