{"id":"CVE-2025-32969","summary":"org.xwiki.platform:xwiki-platform-rest-server allows SQL injection in query endpoint of REST API","details":"XWiki is a generic wiki platform. In versions starting from 1.8 and prior to 15.10.16, 16.4.6, and 16.10.1, it is possible for a remote unauthenticated user to escape from the HQL execution context and perform a blind SQL injection to execute arbitrary SQL statements on the database backend, including when \"Prevent unregistered users from viewing pages, regardless of the page rights\" and \"Prevent unregistered users from editing pages, regardless of the page rights\" options are enabled. Depending on the used database backend, the attacker may be able to not only obtain confidential information such as password hashes from the database, but also execute UPDATE/INSERT/DELETE queries. This issue has been patched in versions 16.10.1, 16.4.6 and 15.10.16. There is no known workaround, other than upgrading XWiki.","aliases":["GHSA-f69v-xrj8-rhxf"],"modified":"2026-08-12T15:16:29.254920Z","published":"2025-04-23T15:33:03.732Z","database_specific":{"cwe_ids":["CWE-89"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/32xxx/CVE-2025-32969.json","cna_assigner":"GitHub_M"},"references":[{"type":"WEB","url":"https://jira.xwiki.org/browse/XWIKI-22691"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/32xxx/CVE-2025-32969.json"},{"type":"ADVISORY","url":"https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-f69v-xrj8-rhxf"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-32969"},{"type":"FIX","url":"https://github.com/xwiki/xwiki-platform/commit/5c11a874bd24a581f534d283186e209bbccd8113"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/xwiki/xwiki-commons","events":[{"introduced":"10aac24eea2647c0e044176c369755baf8c5a5f1"},{"fixed":"d8a509c53e75e2773666a2824b6f8e24c650419f"},{"introduced":"918ea43fe0d277c28efa21a871175b329c75157c"},{"fixed":"8c14d05055fc563d2838c2c9bb141e91d7401386"},{"introduced":"526fcc68b3f75862a2af7395b5a6dfdd3d2166a5"},{"fixed":"a29ceaa6a74f0fee7b8131549bb67aa489d66399"}],"database_specific":{"cpe":"cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"1.8"},{"fixed":"15.10.16"},{"introduced":"16.0.0"},{"fixed":"16.4.6"},{"introduced":"16.5.0"},{"fixed":"16.10.1"}],"source":"CPE_RANGE"}},{"type":"GIT","repo":"https://github.com/xwiki/xwiki-platform","events":[{"introduced":"943ce46958cb17adcf82e8fa381fb36616646f0b"},{"fixed":"110b60483db6e4ba9b1edfc0747a94a81d5296cf"},{"introduced":"3c6f5cf138d8095f63631e554ba448e4b780e162"},{"fixed":"5292357f68df062a1b2f6a48410c3753e94771d3"},{"introduced":"177e524c2e218fe5de776619271b7cd12c929488"},{"fixed":"ce9ec01ee77a3c38f1038e567a34e4f215472f7a"},{"fixed":"5c11a874bd24a581f534d283186e209bbccd8113"}],"database_specific":{"cpe":"cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"1.8"},{"fixed":"15.10.16"},{"introduced":"16.0.0"},{"fixed":"16.4.6"},{"introduced":"16.5.0"},{"fixed":"16.10.1"}],"source":["CPE_RANGE","REFERENCES"]}}],"database_specific":{"vanir_signatures":[{"signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/5c11a874bd24a581f534d283186e209bbccd8113","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/store/hibernate/query/HqlQueryExecutor.java","function":"execute"},"deprecated":false,"digest":{"function_hash":"71915635600221943123647699532298182706","length":711},"id":"CVE-2025-32969-09d89a30"},{"deprecated":false,"digest":{"length":116,"function_hash":"306395792679406814640629565748200668800"},"id":"CVE-2025-32969-1195f631","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/5c11a874bd24a581f534d283186e209bbccd8113","target":{"function":"isSafeSelect","file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/store/hibernate/query/HqlQueryExecutor.java"}},{"deprecated":false,"digest":{"function_hash":"233922180488403057442915999890019646400","length":298},"id":"CVE-2025-32969-3fa61234","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/5c11a874bd24a581f534d283186e209bbccd8113","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/store/hibernate/query/HqlQueryExecutor.java","function":"completeShortFormStatement"}},{"signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/5c11a874bd24a581f534d283186e209bbccd8113","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/test/java/com/xpn/xwiki/store/hibernate/query/HqlQueryExecutorTest.java","function":"executeDeleteWithoutProgrammingRight"},"deprecated":false,"digest":{"function_hash":"107409280835079837727752034686034924136","length":331},"id":"CVE-2025-32969-49b68d81","signature_type":"Function"},{"digest":{"function_hash":"294377677331894544418678194371021021646","length":283},"id":"CVE-2025-32969-620fbbbf","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/5c11a874bd24a581f534d283186e209bbccd8113","target":{"function":"executeNamedQueryWithoutProgrammingRight","file":"xwiki-platform-core/xwiki-platform-oldcore/src/test/java/com/xpn/xwiki/store/hibernate/query/HqlQueryExecutorTest.java"},"deprecated":false},{"id":"CVE-2025-32969-70287893","signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/5c11a874bd24a581f534d283186e209bbccd8113","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/store/hibernate/query/HqlQueryExecutor.java"},"deprecated":false,"digest":{"line_hashes":["29764526124369944672324866449783540557","179711466439194561300222319680867299661","127633609887690088571545857944868738808","40455291728265088513713268511348506851","85744672462029274063092310089594662476","236176168300607007479217637185041643181","264453146272680758401820548567445256421","338031168609902461399610544616053548713","340261382256231532222641352929139775198","138821291300670567233780494264446854989","275438346186718507494470713953503739760","296669765919584294326497711199856380416","82283445128147193112646224029479066069","311148889890884416236194322277632515653","116534222086187315656958438108381145616","76822058297070574824722918268058409069","330765008690800222872980223424753466789","263171266468059606015495646536831250124","46981383010789327379516600524657099279","113721258553452847839540818339737019977","139444525181225832612645452873598015917","64864685424462812772007918145889806613","314139688933855665279390545945856987676","12822071480228796020052852926827852163","174283424488504624758079841244797273768","227352637001080134736640261704886962892"],"threshold":0.9}},{"source":"https://github.com/xwiki/xwiki-platform/commit/5c11a874bd24a581f534d283186e209bbccd8113","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/test/java/com/xpn/xwiki/store/hibernate/query/HqlQueryExecutorTest.java"},"deprecated":false,"digest":{"line_hashes":["219851029763773319196868600970018094035","261544324917813846515875472916004452811","230315282388757225184550174926154351509","260331074652396965332409437517175704487","219218616056967809266041797383852728122","8110875020460993032167425669953606240","280090052601423837829575180727896177091","193061006595212668909962490204220757723","134916061914545865124974168043990710258","330079849680996336044395542940998535455","226209220190226958366234723348656411935","193061006595212668909962490204220757723","180704923359856214733066600562975004259","323474709890049761797079909414095126237","43191054265259561442640258098246435605","41537157746836183514445801741080293043","165016736940197089901134590890488391244","101588323801411939059739276987034374365","296812791529938736014707118618517735933","77132510386940289335568073180119567752"],"threshold":0.9},"id":"CVE-2025-32969-747d7c00","signature_type":"Line","signature_version":"v1"},{"signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/5c11a874bd24a581f534d283186e209bbccd8113","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/test/java/com/xpn/xwiki/internal/store/hibernate/query/HqlQueryUtilsTest.java","function":"isSafe"},"deprecated":false,"digest":{"function_hash":"229987505567189240458760747389754293208","length":1748},"id":"CVE-2025-32969-7b381682","signature_type":"Function"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/5c11a874bd24a581f534d283186e209bbccd8113","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/test/java/com/xpn/xwiki/internal/store/hibernate/query/HqlQueryUtilsTest.java"},"deprecated":false,"digest":{"line_hashes":["125654086155492223015484826810588147386","30364311566075007780491846591882008021","8344953984289394105758456829646653205","101857731986020391442691056316455449076"],"threshold":0.9},"id":"CVE-2025-32969-8122b6ea"},{"id":"CVE-2025-32969-b3ee5d73","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/5c11a874bd24a581f534d283186e209bbccd8113","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/test/java/com/xpn/xwiki/store/hibernate/query/HqlQueryExecutorTest.java","function":"executeUpdateWithoutProgrammingRight"},"deprecated":false,"digest":{"function_hash":"215233641137331323629783887372883594653","length":339}},{"deprecated":false,"digest":{"function_hash":"121575240036273865284335149093372902448","length":488},"id":"CVE-2025-32969-bf51425b","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/5c11a874bd24a581f534d283186e209bbccd8113","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/store/hibernate/query/HqlQueryExecutor.java","function":"checkAllowed"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/5c11a874bd24a581f534d283186e209bbccd8113","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/test/java/com/xpn/xwiki/store/hibernate/query/HqlQueryExecutorTest.java","function":"executeWhenNotAllowedSelect"},"deprecated":false,"digest":{"function_hash":"20393380694833077298953439474497577440","length":380},"id":"CVE-2025-32969-c55872dc"},{"target":{"file":"xwiki-platform-core/xwiki-platform-rest/xwiki-platform-rest-server/src/main/java/org/xwiki/rest/internal/resources/search/AbstractDatabaseSearchSource.java"},"deprecated":false,"digest":{"line_hashes":["44124520486397976206307052806192627580","251445392816854700740684931045063151111","253488817032808963984866237992168049653","204521460034917831617833961954806782725"],"threshold":0.9},"id":"CVE-2025-32969-d6c548d7","signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/5c11a874bd24a581f534d283186e209bbccd8113"}],"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-32969.json","vanir_signatures_modified":"2026-08-12T15:16:29Z"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}]}