SQL Injection Vulnerability in XWiki Affects Multiple Versions

CVE-2025-32968

Summary

XWiki, a versatile wiki platform, is exposed to a SQL injection vulnerability that allows users with SCRIPT rights to escape the HQL execution context. This flaw is present in multiple versions prior to 15.10.16, 16.4.6, and 16.10.1. Exploitation may enable malicious actors to execute arbitrary SQL statements on the backend database, potentially exposing sensitive data like password hashes and allowing unauthorized modifications via UPDATE, INSERT, or DELETE queries. Immediate upgrade to the patched versions is essential as no workarounds exist for this issue. Additionally, the enhancements made to the REST API's protection mechanisms ensure a more consistent validation process for complex queries.

References