HQL Injection Vulnerability in XWiki Platform Affecting Multiple Versions

CVE-2025-52472

What is CVE-2025-52472?

The XWiki Platform contains a vulnerability that allows HQL injection through the 'orderField' parameter in the REST search URL. Specifically, when a user specifies a value for 'orderField', this value is incorporated twice into the query—once in the SELECT field list and again in the ORDER clause. This architectural flaw complicates exploitation, though it is possible when a malicious user takes advantage of the double incorporation within the query. The vulnerability, present in versions starting from 4.3-milestone-1 and up to various builds of 17.x series, has been addressed in subsequent updates. Users are urged to upgrade to versions 16.10.9, 17.4.2, or 17.5.0 to mitigate the risk.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References