CVE-2025-32429

XWiki Platform versions 9.4-rc-1 through 16.10.5 and 17.0.0-rc-1 through 17.2.2 contain a SQL injection flaw (CWE-89) in the getdeleteddocuments.vm template, where the 'sort' request parameter is inserted as-is into an SQL ORDER BY clause without sanitization. Because the endpoint is reachable over the network with no privileges or user interaction required (CVSS 4.0 9.3, AV:N/PR:N/UI:N), any remote attacker who can reach the wiki can submit crafted 'sort' values to inject SQL. Successful injection gives the attacker high impact on the confidentiality, integrity and availability of the underlying database, typically enabling arbitrary query manipulation and data exfiltration. All XWiki deployments running the affected 9.4 through 16.10.5 or 17.0.0-rc-1 through 17.2.2 versions are affected. No public proof-of-concept or confirmed in-the-wild exploitation is known yet, but the EPSS score of 85.3% (100th percentile) indicates a very high likelihood of exploitation within the next 30 days.

What to do: Upgrade to XWiki 16.10.6 if running the 16.10.x LTS line, or to 17.3.0-rc-1 or later (final 17.3.0 when available) if running 17.x; there is no fixed patch for older branches, so upgrades are the primary fix. Until patched, restrict network access to the wiki and consider filtering or validating the 'sort' parameter on getdeleteddocuments requests at a WAF or reverse proxy. Review access logs for anomalous or overly long 'sort' values in requests to getdeleteddocuments.vm to check for exploitation attempts.