CVE-2025-32969

Deeper analysis

XWiki is a generic wiki platform affected by a blind SQL injection vulnerability in versions from 1.8 through 15.10.15, 16.4.5, and 16.10.0. The flaw allows a remote unauthenticated attacker to escape the HQL execution context and inject arbitrary SQL statements against the database backend, bypassing the platform's options that restrict unregistered users from viewing or editing pages. The issue stems from insufficient sanitization in HQL query handling and is tracked as CWE-89.

An unauthenticated remote attacker can exploit the vulnerability over the network to execute SELECT queries that extract sensitive data such as password hashes, and on many database backends also run UPDATE, INSERT, or DELETE statements that alter or destroy content. The CVSS 4.0 score of 9.3 reflects the combination of network attack vector, low complexity, and high impact on confidentiality, integrity, and availability without any required privileges or user interaction.

The official XWiki security advisory and accompanying patches state that the issue is resolved in releases 15.10.16, 16.4.6, and 16.10.1; the project provides no workaround other than upgrading. A linked commit on the xwiki-platform repository and the corresponding Jira ticket document the code change that closes the HQL escape path.

EPSS for the CVE rose from a low baseline to a peak of 0.3140 on 2026-05-05 before receding to the current value of 0.1280, indicating measurable post-disclosure exploitation interest that later subsided.