Log in Start free

Vulnerability · Published Jul 26, 2025 · Assigned by GitHub_M

CVE-2025-54385XWiki Platform's searchDocuments API allows for SQL injection

High 8.6

In plain English

A high-severity improper input validation in xwiki-platform from xwiki. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 53% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)8.6High
Exploit odds (30 days)0.7%top 47.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions between 17.0.0-rc1 to 17.2.2 and versions 16.10.5 and below, it's possible to execute any SQL query in Oracle by using the function like DBMS_XMLGEN or DBMS_XMLQUERY. The XWiki#searchDocuments APIs pass queries directly to Hibernate without sanitization. Even when these APIs enforce a specific SELECT clause, attackers can still inject malicious code through HQL's native function support in other parts of the query (such as the WHERE clause). This is fixed in versions 16.10.6 and 17.3.0-rc-1.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Mavenorg.xwiki.platform:xwiki-platform-oldcore16.10.6GHSA-p9qm-p942-q3w5
Mavenorg.xwiki.platform:xwiki-platform-oldcore17.3.0-rc-1GHSA-p9qm-p942-q3w5

Affected products (as reported)

VendorProductVersions
xwiki xwiki-platform < 16.10.6>= 17.0.0-rc1, < 17.3.0-rc-1

Weakness: CWE-20 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References