CVE-2025-54385 is a critical (CVSS 9.8) flaw in XWiki Platform where the searchDocuments APIs pass queries to Hibernate unsanitised, allowing arbitrary SQL on Oracle through functions such as DBMS_XMLGEN. It is fixed in 16.10.6 and 17.3.0-rc-1. The sections below cover who is affected, how to check, and what to do first.
What's affected
- Versions 17.0.0-rc1 through 17.2.2 are affected.
- Versions 16.10.5 and below are affected.
- Fixed in 16.10.6 and 17.3.0-rc-1.
- The record frames the risk around Oracle databases, because the functions named are Oracle functions.
The record lists CVSS 9.8 (Critical). It is not on the CISA Known Exploited Vulnerabilities list as of the record.
How to check if you're exposed
Check your XWiki version in the About page of the wiki, then check which database it uses in hibernate.cfg.xml.
grep -i "connection.url" WEB-INF/hibernate.cfg.xml
If the URL points to Oracle and the version is in the affected ranges, you are exposed.
What to do now
- Upgrade to 16.10.6 or 17.3.0-rc-1 or later, depending on your branch.
- Read the 16.10.6 release notes before you upgrade.
- Review which users and extensions can run script that calls the search APIs.
- Reduce the privileges of the database account XWiki uses.
- Audit custom code that builds queries from user input.
- Run the free in browser dependency scan to find affected components across your projects, then check the Gold entry for updates.
Work in that order. Inventory first, because you cannot patch what you do not know you run. Fix the internet facing and shared systems before the internal ones, and write down the version you ended up on so the next review starts from facts rather than memory.
Why it matters
The record tags the flaw as CWE-20, improper input validation. Even where the API fixed the SELECT clause, HQL's native function support left other parts of the query, such as the WHERE clause, open to abuse.
It is a reminder that restricting one part of a query is not the same as controlling the whole thing. Database privileges are the second line of defence when an input check fails.
Severity scores are a starting point. The score for this entry is 9.8, and it describes the worst case for the weakness, not your environment. Weigh it against whether the affected component is reachable from outside, who can talk to it, and what it can touch if it is taken over. Reachability analysis helps with that last question for libraries, and the Gold page for this CVE collects the affected versions in one place.
Quick check
Am I affected if I use another database?
The record focuses on Oracle functions. Upgrade regardless, and read the advisory for details on other databases.
Which fixed version should I pick?
Pick the one on your branch: 16.10.6 for the 16.10 line, 17.3.0-rc-1 or later for 17.x.
Sources
- https://docs.oracle.com/en/database/oracle/oracle-database/19/arpls/DBMS_XMLGEN.html
- https://github.com/xwiki/xwiki-platform/commit/7313dc9b533c70f14b7672379c8b3b63d1fd8f51
- https://github.com/xwiki/xwiki-platform/commit/7c4087d44ac550610b2fa413dd4f5375409265a5
- https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-p9qm-p942-q3w5
- https://jira.xwiki.org/browse/XWIKI-22728
- https://www.xwiki.org/xwiki/bin/view/ReleaseNotes/Data/XWiki/16.10.6
Last reviewed: 18 October 2026.
