CVE-2025-32968 is a medium-severity SQL Injection vulnerability affecting the XWiki platform, a widely used generic wiki software. The vulnerability exists in versions starting from 1.6-milestone-1 up to but not including 15.10.16, 16.4.6, and 16.10.1. It allows a user with SCRIPT rights to escape the Hibernate Query Language (HQL) execution context and perform blind SQL injection attacks against the underlying database. This means an attacker can craft malicious input that is improperly neutralized, enabling arbitrary SQL commands to be executed on the backend database. Depending on the database backend in use, this can lead to unauthorized disclosure of sensitive data such as password hashes, as well as modification of data through UPDATE, INSERT, or DELETE statements. The vulnerability arises because the REST API that processes these queries did not sufficiently validate or sanitize inputs, allowing special SQL elements to be injected. The issue has been addressed in patched versions 15.10.16, 16.4.6, and 16.10.1 by applying stricter validation similar to protections used for complete select queries. However, this stricter validation may require users to have higher privileges (programming rights) for complex queries that were previously allowed. No known workarounds exist other than upgrading to a patched version. There are no known exploits in the wild at this time, but the potential impact is significant given the ability to execute arbitrary SQL commands if exploited. The vulnerability requires the attacker to have SCRIPT rights, which implies some level of authenticated access, but once obtained, the attacker can leverage this flaw to compromise confidentiality, integrity, and availability of the data stored in the XWiki database.

For European organizations using XWiki as a collaboration or knowledge management platform, this vulnerability poses a significant risk. An attacker with SCRIPT rights could exfiltrate sensitive corporate data, including user credentials, intellectual property, or internal documentation, potentially leading to data breaches and compliance violations under GDPR. The ability to modify database contents could disrupt business operations, corrupt data integrity, or enable further lateral movement within the network. Since XWiki is often deployed in enterprise environments, including government, education, and private sectors, exploitation could impact critical infrastructure or sensitive projects. The lack of a workaround means organizations must prioritize patching to prevent exploitation. Additionally, the requirement for SCRIPT rights limits the attack surface but does not eliminate risk, especially in environments where user privilege management is lax or where insider threats exist. The impact on availability could arise if attackers perform destructive SQL commands, causing service outages or data loss. Overall, the vulnerability threatens confidentiality, integrity, and availability of organizational data and services relying on XWiki.

1. Immediate upgrade of all affected XWiki instances to the patched versions 15.10.16, 16.4.6, or 16.10.1 as applicable. This is the only effective mitigation since no workarounds exist. 2. Review and restrict SCRIPT rights assignment to only trusted and necessary users to minimize the attack surface. Implement strict role-based access controls and regularly audit user privileges. 3. Monitor logs for unusual HQL or SQL query patterns that could indicate attempted exploitation, focusing on users with SCRIPT rights. 4. Employ database activity monitoring tools to detect anomalous SQL commands, especially UPDATE, INSERT, or DELETE statements originating from the XWiki application. 5. Harden the underlying database by applying least privilege principles to the database user account used by XWiki, limiting its ability to perform destructive operations if possible. 6. Consider network segmentation and application-layer firewalls to restrict access to the XWiki platform and its database backend. 7. Educate administrators and developers about the risks of SQL injection and the importance of applying vendor patches promptly. 8. For complex queries that require programming rights due to the new strict validation, review and adjust user roles accordingly to balance security and functionality.