CVE-2025-32969: XWiki unauthenticated HQL escape leads to blind SQL injection

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityUnauthenticated remote SQL injection with CVSS 4.0 score 9.3, high EPSS and public exploit material, though not in KEV.

What it is

XWiki versions from 1.8 before 15.10.16, 16.4.6 and 16.10.1 allow a remote unauthenticated user to escape the HQL execution context and perform blind SQL injection against the database backend. The flaw bypasses the settings that block unregistered users from viewing or editing pages, so it is reachable even on hardened configurations. It matters because it exposes the database directly to unauthenticated attackers.

Impact

An attacker can read confidential data such as password hashes and, depending on the database backend, run UPDATE, INSERT and DELETE statements to alter or destroy data.

Attack surface

Reachable over the network with no authentication and no user interaction, per the CVSS 4.0 vector (AV:N/PR:N/UI:N). The description states the injection works even when unregistered users are prevented from viewing or editing pages.

Exploitation

Not listed in CISA KEV and no ransomware use documented. EPSS is 0.77774 (99.5th percentile), and the vendor advisory reference is tagged Exploit, indicating public exploit material exists.

What to do

• Upgrade to XWiki 16.10.1, 16.4.6 or 15.10.16; no workaround exists other than upgrading.
• If immediate upgrade is impossible, restrict network access to the XWiki instance to trusted users only.
• Rotate database credentials and any password hashes stored in the XWiki database after patching.
• Review database accounts used by XWiki and remove unnecessary UPDATE/INSERT/DELETE privileges where feasible.

Detection

• Monitor XWiki and database logs for anomalous HQL or SQL query patterns, especially blind-injection timing or boolean probes.
• Alert on database queries originating from unauthenticated XWiki sessions or unexpected source contexts.
• Audit database activity for unexpected UPDATE, INSERT or DELETE statements against XWiki tables.
• Watch for access to XWiki endpoints from unauthenticated clients that precede unusual database load or errors.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.