{"id":"CVE-2025-52472","summary":"XWiki Platform vulnerable to HQL injection via wiki and space search REST API","details":"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting in version 4.3-milestone-1 and prior to versions 16.10.9, 17.4.2, and 17.5.0, the REST search URL is vulnerable to HQL injection via the `orderField` parameter. The specified value is added twice in the query, though, once in the field list for the select and once in the order clause, so it's not that easy to exploit. The part of the query between the two fields can be enclosed in single quotes to effectively remove them, but the query still needs to remain valid with the query two times in it. This has been patched in versions 17.5.0, 17.4.2, and 16.10.9. No known workarounds are available.","aliases":["GHSA-gprp-h92g-gc2h"],"modified":"2026-08-12T14:52:43.001882Z","published":"2025-10-06T14:53:46.654Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/52xxx/CVE-2025-52472.json","cna_assigner":"GitHub_M","cwe_ids":["CWE-89"]},"references":[{"type":"WEB","url":"https://jira.xwiki.org/browse/XWIKI-23247"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/52xxx/CVE-2025-52472.json"},{"type":"ADVISORY","url":"https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-gprp-h92g-gc2h"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-52472"},{"type":"FIX","url":"https://github.com/xwiki/xwiki-platform/commit/743ebf8696ffa55161ed2c5ecf26b09f69e6bcf1"},{"type":"FIX","url":"https://github.com/xwiki/xwiki-platform/commit/a45eca2af772abb7324e56d7fd2df1ac937bc445"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/xwiki/xwiki-platform","events":[{"introduced":"7878213ba6bd4b007e9277d45ef79c48c0cec49a"},{"introduced":"445c0831fb8cf5610eda0eb58225890cb2bece6c"},{"fixed":"89e08a6422ec7342c35bfc21191228e2f7f56857"},{"fixed":"55ef6325bb07177d283e8e84040a6c65afebb3d7"},{"fixed":"743ebf8696ffa55161ed2c5ecf26b09f69e6bcf1"},{"fixed":"a45eca2af772abb7324e56d7fd2df1ac937bc445"}],"database_specific":{"extracted_events":[{"introduced":"4.3-milestone-1"},{"fixed":"16.10.9"},{"introduced":"17.0.0-rc-1"},{"fixed":"17.4.2"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-52472.json","vanir_signatures_modified":"2026-08-12T14:52:43Z","vanir_signatures":[{"deprecated":false,"digest":{"line_hashes":["264920635722433320133552762591873246650","80537248098748631403944970527953331542","319380091291869020510407555426524862674","181848877384094212643225860986683055705","45441990640926916743572792384914356183","14736804285077465713650473725539388714","234549238805963729313685674125638946438","25794196493261016625011867141587813117","223758039110397874430155733434709628244","692428865844126647790648284035792553","204148930945372256723436607441889134896","262380785711392389557203436990745914228","65565153437458595739942731354590916271","22958578442243531962362762892175876195","65503075251055410117493377822056147527","139396658654974828471002578599176464485","154640207775498548024044896389411303799","90312832907197036325003741221469717473","120240245966897389172444991452196711248","191362421938506867301943657124023248915","206297489438265837482860698758865486872","46410138842189941277984084602803314090","116126647620274954819432460698906515018","93438689198933332865915760417990622373","50592886237023727818890183548720529492","295873801671941193597656014919801331941","97506276474378517093811690899054049473","152635011530328619314993449798179374583","21977810126915343580085459413328751953","324426580821461224801407870073651681942","174998228877367817262886656120257597487","332714805792767609741806390480093310459","257746912595987454139820631833667056073","153144173284136118639086229255995861642","34888003866186506004160388639146776948","308026477114750199283281138322805764226","307820475749681798839093346421635527869","288260030843436781287540464335493245949","220043821622757854609572073018834497563","192578687462616356268049338811549764595","224994587617482437911989284405544447663","338907767421543491186175760097742588913","245616479817156637031160638361718851621","182824121816189884626254288072370418036","56905828007814316240752173182029863096","107786009127378288506961976784459789529","156752097644980870877288299406924818881","273948663365191829155286754985133681311","261592551563546098967165769319949201277","151673642331173305914615364666428650226","120850888849952890455103432515791484779","190388661033358017214328575585811383456","339673720495377480127212864375051424308","51862940258172605478673171968886979248","45403260454616265575939768871028031844","149903482342506425487253421427414796975","103113473310493686588210787028751306820","249813950221112818369402047268892041319","135366718334470453251611487916728866052","287852538712436888248338417203565343953","313164174066840118160637072405908505451","72630291246401356365988324912374904987","148872605416502202557676282649824038466","269923104648120560882238078698186264260","57117156968525706699145942284682615717","152480120388072130647673095941423602035","148067041947607650438493501852300436154","172207821300399454662143048920240942752","333000436044511588452193685936362754255","226227912482698819222431076032127186482","38989453997043454722720767424514813146","219065376701920986017955086253794109843","118986775274177289212309797931025001751","154765778738460058227150953686946468151","174991898458253729382268058603560672963","314657006388322625729229949422124371453","246445044317443265575493287017935180138","187403903609325268564935057607660474058","73213127227391591457035409257308948500","6507316235013739413475964428002160412","75857287841752936126770430879939391842","336226197542980174774031337831299236354","6400394938051170862457182433402827086","178655520166164814557012685452422764479","149749712184433598071414622236251123738","137203744155922643049464484975058188774","270645045223390782002385803932778411461","23985079890832904274722494141408361530","104500353713444735242738446886648703400","99478374656168102354960579328462917824","48599132862103161538091376868697352023","114867002289548924261354250312865621773","239323627209346689492230673843879889211","180964380257343871496671485210271934534","186485859913084141340146803400062791629","295691611295920283789842270425815388821","318227347882123729440245797281943732207","74377679625164431906331701220884923828","88918475289151013510842503560143723044","240477671510446148808236870068923946852","319805125292910323437779427930889821880","301958838443573132132495061147355065770","234298235946473769488031396218781764870","222684145340529424615188001161438682629","221074804314499817440771220878883810082"],"threshold":0.9},"id":"CVE-2025-52472-06542d5d","signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/a45eca2af772abb7324e56d7fd2df1ac937bc445","target":{"file":"xwiki-platform-core/xwiki-platform-rest/xwiki-platform-rest-server/src/main/java/org/xwiki/rest/internal/resources/DatabaseKeywordSearchSource.java"}},{"signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/743ebf8696ffa55161ed2c5ecf26b09f69e6bcf1","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/internal/store/hibernate/query/HqlQueryUtils.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["326052865136351706143782901429062543774","106590621291578375619974261272417014850","280147270115297494386334734711055663348","231414046054836698383737718609057730156","207176098971761150937219659867631023334","169613615864736643837360775492444664845"]},"id":"CVE-2025-52472-2dabb466","signature_type":"Line"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/743ebf8696ffa55161ed2c5ecf26b09f69e6bcf1","target":{"file":"xwiki-platform-core/xwiki-platform-rest/xwiki-platform-rest-server/src/main/java/org/xwiki/rest/internal/resources/BaseSearchResult.java","function":"searchPages"},"deprecated":false,"digest":{"function_hash":"242152692312857272947914616896484999917","length":3597},"id":"CVE-2025-52472-335b5a90"},{"digest":{"function_hash":"136517032982876107244724943897611808654","length":1582},"id":"CVE-2025-52472-37ce0b55","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/743ebf8696ffa55161ed2c5ecf26b09f69e6bcf1","target":{"file":"xwiki-platform-core/xwiki-platform-rest/xwiki-platform-rest-server/src/main/java/org/xwiki/rest/internal/resources/ModificationsResourceImpl.java","function":"getModifications"},"deprecated":false},{"digest":{"function_hash":"48538038570594063984222434951371791747","length":1617},"id":"CVE-2025-52472-3f4b43e3","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/743ebf8696ffa55161ed2c5ecf26b09f69e6bcf1","target":{"file":"xwiki-platform-core/xwiki-platform-rest/xwiki-platform-rest-server/src/main/java/org/xwiki/rest/internal/resources/pages/PageHistoryResourceImpl.java","function":"getPageHistory"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"247119896938518901176331948353635740769","length":3743},"id":"CVE-2025-52472-54850268","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/a45eca2af772abb7324e56d7fd2df1ac937bc445","target":{"function":"searchPages","file":"xwiki-platform-core/xwiki-platform-rest/xwiki-platform-rest-server/src/main/java/org/xwiki/rest/internal/resources/DatabaseKeywordSearchSource.java"}},{"signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/743ebf8696ffa55161ed2c5ecf26b09f69e6bcf1","target":{"function":"searchSpaces","file":"xwiki-platform-core/xwiki-platform-rest/xwiki-platform-rest-server/src/main/java/org/xwiki/rest/internal/resources/BaseSearchResult.java"},"deprecated":false,"digest":{"function_hash":"302623309605434049496550760961071150783","length":2003},"id":"CVE-2025-52472-616f9b58","signature_type":"Function"},{"target":{"file":"xwiki-platform-core/xwiki-platform-rest/xwiki-platform-rest-server/src/main/java/org/xwiki/rest/internal/resources/pages/PageHistoryResourceImpl.java"},"deprecated":false,"digest":{"line_hashes":["252826264824883907233398551446172943862","76797886069042444502250430291440294349","298460319954706893006033878020874355776","339643526976016218961740471746465166707","37372641083463720326802299230886375562","143035982150812674096589614636371216924","238292641862317192684234299976224633294","219808633817237785922607830557687641089","284124927035003376720261158490206723295","158877461279125668274276275397696221747","261724216163187150147998066113655015163","55194411012088439647314992540688451454","338963232776060325112420347480915175335","299058182586915936215317935631265386887","125394458266901593286552386437241020828"],"threshold":0.9},"id":"CVE-2025-52472-7038ad53","signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/743ebf8696ffa55161ed2c5ecf26b09f69e6bcf1"},{"id":"CVE-2025-52472-769cffb8","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/a45eca2af772abb7324e56d7fd2df1ac937bc445","target":{"file":"xwiki-platform-core/xwiki-platform-rest/xwiki-platform-rest-server/src/main/java/org/xwiki/rest/internal/resources/DatabaseKeywordSearchSource.java","function":"searchObjects"},"deprecated":false,"digest":{"function_hash":"125794265429449060712053009720402726956","length":4439}},{"signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/743ebf8696ffa55161ed2c5ecf26b09f69e6bcf1","target":{"file":"xwiki-platform-core/xwiki-platform-rest/xwiki-platform-rest-server/src/main/java/org/xwiki/rest/internal/resources/ModificationsResourceImpl.java"},"deprecated":false,"digest":{"line_hashes":["145654739288050706942662072765713528672","285030461548567026604808722358744072941","293814432303826312709442542996074077424","35824459017490090658221918094000682860","237093145677797027856546027452254582208","74411589827854720413635573719791824100","118163282256722720256575381396545244062","30792310034949383633050726160348551704","130960610064108899959865016721285752962","337415798766324628136319039919040501862","321602622501092769195799755477351772482","108967483519301944111119593084181213037","205392076029341687174987812521050732345","126910148403427867992603711632368041477","65957215547867062559494358607932644798","156551181748254963988068773475997131452"],"threshold":0.9},"id":"CVE-2025-52472-809595ae","signature_type":"Line"},{"signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/743ebf8696ffa55161ed2c5ecf26b09f69e6bcf1","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/test/java/com/xpn/xwiki/internal/store/hibernate/query/HqlQueryUtilsTest.java"},"deprecated":false,"digest":{"line_hashes":["273547942328633240286958196764587505478","329562472672400908197750863438685577233","59331844118749747807612969203710291167"],"threshold":0.9},"id":"CVE-2025-52472-ade77dea","signature_type":"Line"},{"digest":{"threshold":0.9,"line_hashes":["144188365585769347203025183513568799665","252159589656453482770058081140073791761","170468112777249449947492782960924973022","166431518617959865043893352237553722791","214368953266204362436857460550789057189","132068160425887172256320919334033459721","163110488500362902004829747943767406554","257404444557232819028515112604971009230","64730639906637401113303401275063185781","330522394070916264622308591193318033614","257230364375598917538443873366453029413","135183996447927290968463433018482986781","157512327171057264921571672392025573677","211656419494036948663174084638082609612","7832367563393252267346293348348669750","303019511750258456446260480133745501333","288260030843436781287540464335493245949","325460116762300091477427613010173455627","311743395002760211604822094300168800496","99745616673093922686945440186701165293","104153742434066695406053686105814908148","201775018331089882885395836121917057988","17727856562878349172921659806479920216","217147942337445504469096178438883536508","237601975796333632788572092826499797508","79268050821931996630058633175410939770","323407916759372770328719893573848072491","265418196771415589094680864217546532611","235163713530234892108392576739453938030","207732878446346741656094073496833428501","202204874765728602177044825884421208354","316359549065716478103357452933742551604","161900730336528258507832738251038529534","116496948465821326797103504735327877497","197461986933032262202880418822749192350","200049312125518010852117813359058796572"]},"id":"CVE-2025-52472-bf7c10c9","signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/743ebf8696ffa55161ed2c5ecf26b09f69e6bcf1","target":{"file":"xwiki-platform-core/xwiki-platform-rest/xwiki-platform-rest-server/src/main/java/org/xwiki/rest/internal/resources/BaseSearchResult.java"},"deprecated":false},{"id":"CVE-2025-52472-c55f466e","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/743ebf8696ffa55161ed2c5ecf26b09f69e6bcf1","target":{"file":"xwiki-platform-core/xwiki-platform-rest/xwiki-platform-rest-server/src/main/java/org/xwiki/rest/internal/resources/pages/PageTranslationHistoryResourceImpl.java","function":"getPageTranslationHistory"},"deprecated":false,"digest":{"function_hash":"112355271989940582121407205731524741000","length":1647}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/743ebf8696ffa55161ed2c5ecf26b09f69e6bcf1","target":{"file":"xwiki-platform-core/xwiki-platform-rest/xwiki-platform-rest-server/src/main/java/org/xwiki/rest/internal/resources/pages/PageTranslationHistoryResourceImpl.java"},"deprecated":false,"digest":{"line_hashes":["252826264824883907233398551446172943862","76797886069042444502250430291440294349","42655264695799129810937552959561144661","301542881701738595073808987362875299717","37372641083463720326802299230886375562","143035982150812674096589614636371216924","238292641862317192684234299976224633294","128148230612815006998365531558287584828","12647313212845909747775429393109085634","45752665035291201843176664410636911013","44459539141704066905950633599214514900","224383897938920690641452519244131112345","49327342227712975697793421485138276027","50604894349574259673229014555712914617","336451594322654946274460727561910148717","113229274926572965248256080813166877649"],"threshold":0.9},"id":"CVE-2025-52472-f1ac2f2a"},{"deprecated":false,"digest":{"function_hash":"271225538941836230999945804976951223786","length":2061},"id":"CVE-2025-52472-f47b9be7","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/a45eca2af772abb7324e56d7fd2df1ac937bc445","target":{"file":"xwiki-platform-core/xwiki-platform-rest/xwiki-platform-rest-server/src/main/java/org/xwiki/rest/internal/resources/DatabaseKeywordSearchSource.java","function":"searchSpaces"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/743ebf8696ffa55161ed2c5ecf26b09f69e6bcf1","target":{"file":"xwiki-platform-core/xwiki-platform-rest/xwiki-platform-rest-server/src/main/java/org/xwiki/rest/internal/resources/BaseSearchResult.java","function":"searchObjects"},"deprecated":false,"digest":{"function_hash":"135308866872992691185567177640752557139","length":4223},"id":"CVE-2025-52472-f9c379c4"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}]}