SQL injection in XWiki platform - CVE-2025-52472
Published: May 5, 2026
Vulnerability identifier: #VU129892
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2025-52472
CWE-ID: CWE-89
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary queries.
The vulnerability exists due to SQL injection in the wiki and space search REST API when processing the orderField parameter. A remote attacker can send a specially crafted REST request to execute arbitrary queries.
The injected value is added twice to the generated query, which makes exploitation more constrained but still possible.
Affected software
XWiki platform
How to mitigate CVE-2025-52472
Install security update from vendor's website.
XWiki platform - addressed in versions 16.10.9, 17.4.2, 17.5.0