This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.

[TLP:CLEAR] XWiki fixes 2 vulnerabilities

XWiki Platform versions 16.10.9, 17.5.0 and 17.4.2 and OIDC Authenticator for XWiki version 2.18.2 fix 2 vulnerabilities [1][2].

XWiki - HQL injection (CVE-2025-52472)
CVSS 9.3 (Critical)

Allows an unauthenticated remote attacker to perform an HQL injection attack due to unsanitised and duplicated insertion of the orderField value into the select and order parts of a Hibernate Query Language (HQL) query [1].

The vulnerability is present in product:

  • XWiki; >= 4.3-milestone-1, <16.10.9

CVSS: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

More information:

  • CVE-2025-52472 at cve.org, NVD
  • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') at cwe.mitre.org

The vulnerability was publicly disclosed 6. 10. 2025.

XWiki - authentication bypass (CVE-2025-49594)
CVSS 9.2 (Critical)

Allows an unauthenticated remote attacker to obtain a token for any user whose profile they can view, and subsequently log in as that user, due to insufficient permission checks when creating authentication tokens in the oidc-provider module [2].

The vulnerability is present in product:

  • XWiki OIDC; >= 2.17.1, <2.18.2

CVSS: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

More information:

The vulnerability was publicly disclosed 6. 10. 2025.

By CESNET, z.s.p.o. Michaela Jarošová on 9. 10. 2025.

CESNET, z.s.p.o. Logo