CVE-2025-52472

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting in version 4.3-milestone-1 and prior to versions 16.10.9, 17.4.2, and 17.5.0, the REST search URL is vulnerable to HQL injection via the `orderField` parameter. The specified value is added twice in the query, though, once in the field list for the select and once in the order clause, so it's not that easy to exploit. The part of the query between the two fields can be enclosed in single quotes to effectively remove them, but the query still needs to remain valid with the query two times in it. This has been patched in versions 17.5.0, 17.4.2, and 16.10.9. No known workarounds are available.

• CWE-89

• https://github.com/xwiki/xwiki-platform/commit/743ebf8696ffa55161ed2c5ecf26b09f69e6bcf1
• https://github.com/xwiki/xwiki-platform/commit/a45eca2af772abb7324e56d7fd2df1ac937bc445
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-gprp-h92g-gc2h
• https://jira.xwiki.org/browse/XWIKI-23247

Published

Oct 6, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-52467pgai is a Python library that transforms PostgreSQL into a r…9.1
• CVE-2025-52468Chamilo is a learning management system. Prior to version 1.…6.1
• CVE-2025-52469Chamilo is a learning management system. Prior to version 1.…7.1
• CVE-2025-5247A vulnerability, which was classified as critical, has been …7.3
• CVE-2025-52470Chamilo is a learning management system. Prior to version 1.…4.8
• CVE-2025-52471ESF-IDF is the Espressif Internet of Things (IOT) Developmen…9.8
• CVE-2025-52473liboqs is a C-language cryptographic library that provides i…5.5
• CVE-2025-52474WeGIA is a web manager for charitable institutions. Prior to…9.8
• CVE-2025-52475Chamilo is a learning management system. Prior to version 1.…6.1
• CVE-2025-52476Chamilo is a learning management system. Prior to version 1.…6.1
• CVE-2025-52477Octo-STS is a GitHub App that acts like a Security Token Ser…8.6
• CVE-2025-52478n8n is a workflow automation platform. From 1.77.0 to before…5.4