Patchfirst
Patchfirst
CVE-2025-52472 Public exploit Critical · 9.3 EPSS 2.4%

XWiki Platform vulnerable to HQL injection via wiki and space search REST API

xwiki · xwiki-platform

Summary

XWiki Platform (the xwiki-platform product) has an HQL injection flaw in its REST search endpoint for wiki and space search, where the orderField parameter is not properly neutralised.

Official description · CVE.org

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting in version 4.3-milestone-1 and prior to versions 16.10.9, 17.4.2, and 17.5.0, the REST search URL is vulnerable to HQL injection via the `orderField` parameter. The specified value is added twice in the query, though, once in the field list for the select and once in the order clause, so it's not that easy to exploit. The part of the query between the two fields can be enclosed in single quotes to effectively remove them, but the query still needs to remain valid with the query two times in it. This has been patched in versions 17.5.0, 17.4.2, and 16.10.9. No known workarounds are available.

Breakdown
68.3 / 100
Exploited
Yes, in VulnCheck KEV
Reports
0
Tactics
0/15

First seen exploited 52 days after disclosure.

  1. Disclosedday 0
  2. First seen exploitedVulnCheck KEV evidence+52 days

See the family tree

7 related vulnerabilities in the same code over 3 years. The latest fix listed for xwiki-platform-rest-server is 18.1.0-rc-1.

Same bug familyLinked by evidence that a fix failed or the same code was patched again. Oldest first.

  1. CVE-2022-36100XWiki Platform Applications Tag and XWiki Platform Tag UI…8 Sep 2022
  2. same family
    CVE-2022-41936Exposure of Private Personal Information to an Unauthorized…22 Nov 2022
  3. same family
    CVE-2022-41927XWiki Platform vulnerable to Cross-Site Request Forgery (CSRF)…23 Nov 2022
  4. same family
    CVE-2023-36468Upgrading doesn't prevent exploiting vulnerable XWiki documents29 Jun 2023
  5. same family
    CVE-2024-45591XWiki Platform document history including authors of any page…10 Sep 2024
  6. same family
    CVE-2025-54385XWiki Platform's searchDocuments API allows for SQL injection26 Jul 2025
  7. relatedMedium

    Why these are linked:

    This CVECVE-2025-52472XWiki Platform vulnerable to HQL injection via wiki and space…6 Oct 2025

Fixes in xwiki-platform-rest-serverMaven package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

  1. 16.10.0-rc-1CVE-2025-2992519 Mar 2025
  2. 16.10.1CVE-2025-3296923 Apr 2025
  3. 17.0.0CVE-2025-4958413 Jun 2025
  4. 17.4.2CVE-2025-524726 Oct 2025
  5. 17.7.0-rc-1CVE-2025-6647310 Dec 2025
  6. 18.1.0-rc-1CVE-2026-3313720 May 2026Latest listed

techniques

No techniques linked

No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

1 package in 1 ecosystem. Main package: org.xwiki.platform:xwiki-platform-rest-server.

Mavenorg.xwiki.platform:xwiki-platform-rest-serverGHSA-gprp-h92g-gc2h

Upgrade to 17.4.2 or later

Set the version to 17.4.2 or later in your pom.xml or build.gradle.

The first fix for CVE-2025-52472.

Affected versions, by release line

If you runUpgrade to
17.0.0-rc-1 up to 17.4.217.4.2
4.3-milestone-1 up to 16.10.916.10.9

“Up to” means the second version is the fix and is not affected.

Check your lockfile against all CVEs

What security researchers reported

Not named in any threat report yet

References

4 links, grouped by NVD tag

x_refsource_CONFIRM 1

github.com/xwiki/xwiki-platform/security/advisories/GHSA-gprp-h92g-gc2h

x_refsource_MISC 3

github.com/xwiki/xwiki-platform/commit/743ebf8696ffa55161ed2c5ecf26b09f69e6bcf1github.com/xwiki/xwiki-platform/commit/a45eca2af772abb7324e56d7fd2df1ac937bc445jira.xwiki.org/browse/XWIKI-23247
↑ ↓ chooseEnter openEsc close