CVE-2025-52472: HQL Injection Vulnerability in XWiki Platform REST Server
Summary
CVE-2025-52472: XWiki Platform is vulnerable to HQL injection via wiki and space search REST API. Affects org.xwiki.platform:xwiki-platform-rest-server across 2 version ranges.
>= 4.3-milestone-1, < 16.10.9
>= 17.0.0-rc-1, < 17.4.2
Fixed in 16.10.9 or 17.4.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The XWiki Platform is an open-source wiki software that allows users to create and manage collaborative content. It provides a REST API for searching wikis and spaces, enabling developers to integrate XWiki functionalities into their applications. However, a critical vulnerability has been identified in the REST search API, specifically in the handling of the 'orderField' parameter, which can lead to HQL injection attacks.
Vulnerability Detail
The vulnerability arises from improper handling of the 'orderField' parameter in the REST search URL, allowing attackers to inject HQL (Hibernate Query Language) code. This can lead to unauthorized data access or manipulation. The injected code can be crafted to execute arbitrary queries, potentially exposing sensitive information or disrupting the application's functionality. The complexity of the injection makes it less straightforward to exploit, but it still poses a significant risk to the integrity of the application.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 4.3-milestone-1, < 16.10.916.10.9 -
>= 17.0.0-rc-1, < 17.4.217.4.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
Currently, there are no known workarounds other than upgrading to the patched version of the XWiki Platform. It is recommended to monitor the application for any unusual behavior until the update is applied.
Conclusion
The HQL injection vulnerability in the XWiki Platform REST Server poses a critical risk to applications utilizing this software. Immediate action is required to update to the patched versions to safeguard against potential exploitation. Regular monitoring and updates are essential to maintain security.
See every vulnerability recorded for org.xwiki.platform:xwiki-platform-rest-server →
FAQ
The vulnerability is an HQL injection flaw that allows attackers to manipulate database queries through the REST API.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Check your application against the vulnerability using the Vulert playground.
Exploitation of this vulnerability could lead to unauthorized access to sensitive data or disruption of application functionality.
There are no known workarounds to mitigate this risk other than applying the necessary updates.
For more details, refer to the XWiki Jira page or the GitHub commit history related to this issue.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.xwiki.platform:xwiki-platform-rest-server.
