CVE-2025-32968 org.xwiki.platform:xwiki-platform-oldcore allows SQL injection in short form select requests through the script query API

What is CVE-2025-32968?

CVE-2025-32968 is a high-severity SQL injection vulnerability in Xwiki Xwiki, published on 23 Apr 2025. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

XWiki is a generic wiki platform. In versions starting from 1.6-milestone-1 to before 15.10.16, 16.4.6, and 16.10.1, it is possible for a user with SCRIPT right to escape from the HQL execution context and perform a blind SQL injection to execute arbitrary SQL statements on the database backend. Depending on the used database backend, the attacker may be able to not only obtain confidential information such as password hashes from the database, but also execute UPDATE/INSERT/DELETE queries. This issue has been patched in versions 16.10.1, 16.4.6 and 15.10.16. There is no known workaround, other than upgrading XWiki. The protection added to this REST API is the same as the one used to validate complete select queries, making it more consistent. However, while the script API always had this protection for complete queries, it's important to note that it's a very strict protection and some valid, but complex, queries might suddenly require the author to have programming right.

Weakness: CWE-89

Which versions are affected by CVE-2025-32968?

6 open source packages ship an affected version, including org.xwiki.platform:xwiki-platform-oldcore. It affects 1 product.

Products include Xwiki Xwiki.

How do I fix CVE-2025-32968?

Upgrade org.xwiki.platform:xwiki-platform-oldcore to a fixed version for your release line: 15.10.16, 16.4.6 or 16.10.1.

Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.

Is CVE-2025-32968 being exploited?

There is no known exploitation of CVE-2025-32968 in the wild and no public exploit code.

Other vulnerabilities in Xwiki Xwiki

• CVE-2025-24893 XWiki Platform Eval Injection Exploited Critical 9.8
• CVE-2025-53836 XWiki Rendering is vulnerable to RCE attacks when processing nested macros Critical 10.0
• CVE-2024-55662 XWiki allows remote code execution through the extension sheet Critical 10.0
• CVE-2024-55877 XWiki allows remote code execution from account through macro descriptions and XWiki.XWikiSyntaxMacrosList Critical 10.0
• CVE-2024-37901 XWiki Platform vulnerable to remote code execution from account via SearchSuggestConfigSheet Critical 10.0

All Xwiki Xwiki vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-g9jj-75mx-wjcx.