GitHub Advisoryadvisory · Maven

GHSA-p9qm-p942-q3w5 XWiki Platform vulnerable to SQL injection through XWiki#searchDocuments API

HIGH Published 2025-07-25 Modified 2025-07-28 Official page ↗
Aliases
CVE-2025-54385
Ecosystem
Maven
Packages
org.xwiki.platform:xwiki-platform-oldcore
Severity
High
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Weaknesses
CWE-20, CWE-89
Reviewed
2025-07-25

Affected packages

• Maven org.xwiki.platform:xwiki-platform-oldcore: >= 1.0, < 16.10.6 → fixed in 16.10.6 • Maven org.xwiki.platform:xwiki-platform-oldcore: >= 17.0.0-rc1, < 17.3.0-rc-1 → fixed in 17.3.0-rc-1

Description

Impact It's possible to execute any SQL query in Oracle by using the function like DBMS_XMLGEN or DBMS_XMLQUERY. The XWiki#searchDocuments APIs are not sanitizing the query at all and even if they force a specific select, Hibernate allows using any native function in an HQL query (for example in the WHERE). Patches This has been patched in 16.10.6 and 17.3.0-rc-1. Workarounds There is no known workaround, other than upgrading XWiki. References https://jira.xwiki.org/browse/XWIKI-22728 For more information If you have any questions or comments about this advisory: • Open an issue in Jira XWiki.org • Email us at Security Mailing List

Related

Alias · CVE (1)

  • CVE-2025-54385 XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. vulnerability

Weakness · CWE (2)

  • CWE-20 Improper Input Validation weakness
  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness

References