CVE-2025-32969 is a critical (CVSS 9.8) blind SQL injection in XWiki that needs no login. It affects versions from 1.8 before 15.10.16, 16.4.6 and 16.10.1. The fixes are 15.10.16, 16.4.6 and 16.10.1, and the record says there is no workaround other than upgrading.
What's affected
XWiki versions starting from 1.8 and prior to 15.10.16, 16.4.6 and 16.10.1, per the CVE record. Pick the fixed version that matches your release line: 15.10.16, 16.4.6 or 16.10.1.
The record says a remote unauthenticated user can escape from the HQL execution context and perform a blind SQL injection. It also says this works even when both the options that prevent unregistered users from viewing and from editing pages are enabled, so those settings do not help.
Depending on the database backend, the attacker may read confidential data such as password hashes and may also be able to run update, insert and delete statements. The record states there is no known workaround.
How to check if you're exposed
Find the XWiki version from the About or Administration pages, or read it from the web application files on the server:
ls /usr/local/tomcat/webapps/*/WEB-INF/lib | grep xwiki-platform-oldcore
The path depends on how you deployed XWiki, so adjust it. The version number in the library file name is the platform version.
Compare it against the three fixed versions for your line. Anything older than the fixed version in the same line is affected.
What to do now
- Upgrade to 15.10.16, 16.4.6 or 16.10.1, or a newer release in your line.
- Do not rely on page view or edit restrictions, which the record says do not stop this issue.
- Limit database permissions for the XWiki account to what it needs.
- Review database and web logs for long runs of similar requests that look like data probing.
- If you suspect misuse, reset passwords for wiki users, since password hashes can be read.
Why it matters
The class is CWE-89 (SQL Injection). XWiki lets users and pages run queries in HQL, its Hibernate query language. The record says it was possible to escape that context and reach raw SQL on the backend.
Blind injection means the page does not show query results directly. The caller infers data from differences in behavior, which is slower but effective. A wiki often holds internal knowledge, so the data at stake can be sensitive.
The record does not mark this CVE as CISA KEV and makes no claim of exploitation in the wild.
Try it yourself
When a fix exists for your release line, the job is to find the right version fast. This demo shows how a scan points at available fixes.
Click through it at your own pace, or open it full screen.
Quick check
Is there a workaround?
The record says there is no known workaround other than upgrading XWiki.
Sources
- CVE-2025-32969 record on Safeguard Gold
- XWiki advisory GHSA-f69v-xrj8-rhxf
- XWIKI-22691 on the project tracker
- Fix commit
Last reviewed: 18 October 2026.
