CVE-2025-32969

XWiki versions from 1.8 up to (but not including) 15.10.16, 16.4.6, and 16.10.1 allow a remote, unauthenticated attacker to escape the HQL execution context and perform a blind SQL injection, executing arbitrary SQL statements against the database backend. The flaw is reachable even when the wiki is configured with "Prevent unregistered users from viewing pages" and "Prevent unregistered users from editing pages" enabled, so guest-accessible instances require no credentials to exploit. Depending on the database backend, the attacker can read confidential data such as password hashes and may run UPDATE, INSERT, and DELETE queries, giving substantial control over the database. All deployments running affected XWiki versions are exposed, and the vendor lists no workaround other than upgrading. Exploitation has not been confirmed in the wild and the issue is not in CISA KEV, but a public advisory exists and EPSS assigns a 77.8% probability of exploitation within 30 days (100th percentile), indicating high near-term risk.

What to do: Upgrade XWiki to 16.10.1, 16.4.6, or 15.10.16 (or any later release), as the advisory lists no application-level workaround. Until patched, limit network access to the instance and review database logs for unexpected SQL activity or read/write access to password hash tables. Treat internet-facing instances that allow unauthenticated access as the highest priority for patching.