SQL Injection Vulnerability in XWiki Platform Versions 16.10.5 and Below

CVE-2025-54385

What is CVE-2025-54385?

The XWiki Platform is prone to SQL injection vulnerabilities in versions 17.0.0-rc1 to 17.2.2, as well as in versions 16.10.5 and below. This allows attackers to execute arbitrary SQL queries on Oracle databases via the use of functions like DBMS_XMLGEN and DBMS_XMLQUERY. The issue arises because the XWiki#searchDocuments APIs pass queries to Hibernate without proper sanitization. Consequently, even when specific SELECT clauses are enforced, attackers can inject harmful code through HQL's native function capabilities in other areas of the query. The vulnerability has been addressed in versions 16.10.6 and 17.3.0-rc-1.

References