CVE-2025-32429 is a critical (CVSS 9.8) SQL injection in XWiki Platform. Anyone can inject SQL through the sort parameter of the getdeleteddocuments.vm template. The fixed releases are 16.10.6 and 17.3.0-rc-1, and the advisory says there is no known workaround, so upgrade.
What's affected
The NVD record gives two ranges: versions 9.4-rc-1 through 16.10.5, and 17.0.0-rc-1 through 17.2.2. The GitHub advisory GHSA-vr59-gm53-v7cq lists the Maven package org.xwiki.platform:xwiki-platform-distribution-war, affected from 9.4-rc-1, with patched versions 17.3.0-rc-1 and 16.10.6.
The cause is that the sort parameter of the getdeleteddocuments.vm template is placed into the query as an ORDER BY value as is. The weakness class is CWE-89. The CVSS 3.1 vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. That means network reachable, no login, low complexity and high impact on all three properties.
The advisory credits Aleksey Solovev of Positive Technologies with the report. The record's KEV flag is false and the advisory does not report exploitation in the wild.
How to check if you're exposed
Find your XWiki version from the About page, or from the file name of the web application archive.
unzip -p xwiki.war META-INF/MANIFEST.MF 2>/dev/null | head
ls webapps/xwiki/WEB-INF/lib | grep xwiki-platform-oldcore
The version in the oldcore jar name is the platform version. Compare it with the ranges above. Containers deserve the same check, so look at the image tag. If you run a managed hosting service, ask the provider which version it runs.
An instance that is open to anonymous visitors is the most exposed, since the advisory says anyone can reach the flaw.
What to do now
- Upgrade to 16.10.6 if you are on the 16.10 line, or 17.3.0-rc-1 or later on the 17 line. For older lines, move to a supported release, since the affected range starts at 9.4.
- Redeploy and confirm the new version on the About page.
- If you cannot upgrade today, put the wiki behind authentication at the proxy. The advisory says there is no known workaround inside XWiki, so this is a stopgap and not a fix.
- Review the database for changes you did not make, and check access logs for unusual requests with a
sortparameter. - Make sure the database account that XWiki uses has only the rights it needs.
The free in-browser dependency scan takes a manifest or lockfile and lists known CVEs for the packages in it, and the Gold directory lets you look up a CVE by id.
Why it matters
An ORDER BY clause cannot be filled by a bound parameter in many databases, so developers often append the column name as text. That is how this class of bug survives in code that otherwise uses prepared statements. The safe approach is an allow list of column names, mapped to fixed text in the code.
A wiki holds internal knowledge, user accounts and sometimes credentials pasted into pages. SQL injection with no login and high impact on all three properties makes this one of the more serious entries in this batch.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which versions fix CVE-2025-32429?
16.10.6 and 17.3.0-rc-1, according to the advisory.
Is there a workaround?
The advisory says none is known other than upgrading.
Sources
Last reviewed: 19 October 2026.
