HQL Hell: Breaking XWiki with a Single Quote and a Dream

Alon Barad

Software Engineer

Jan 3, 2026·7 min read·19 visits

Weaponized

Executive Summary (TL;DR)

XWiki exposed a REST endpoint that accepts HQL queries. Due to a flaw in how 'short-form' queries were validated versus how they were executed, attackers can escape the HQL context. This results in unauthenticated Blind SQL Injection, leading to full database compromise and potential RCE. Rated CVSS 9.8.

A critical unauthenticated HQL injection vulnerability in XWiki's REST API allows attackers to break out of the Hibernate Query Language abstraction and execute raw SQL on the underlying database.

Attack Flow Diagram

Official Patches

XWikiGitHub Commit fixing the vulnerability

XWikiJira Issue Tracking

Fix Analysis (1)

Technical Appendix

CVSS Score

9.8/ 10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Probability

25.20%

Top 4% most exploited

5,000

Estimated exposed hosts via Shodan

Affected Systems

XWiki Platform < 15.10.16XWiki Platform 16.0.0-rc-1 to < 16.4.6XWiki Platform 16.5.0-rc-1 to < 16.10.1

Affected Versions Detail

Product	Affected Versions	Fixed Version
XWiki Platform XWiki	1.8 - < 15.10.16	15.10.16
XWiki Platform XWiki	16.0.0 - < 16.4.6	16.4.6
XWiki Platform XWiki	16.5.0 - < 16.10.1	16.10.1

Attribute	Detail
CWE ID	CWE-89 (SQL Injection)
Attack Vector	Network (REST API)
CVSS v3.1	9.8 (Critical)
CVSS v4.0	9.3 (Critical)
EPSS Score	25.20%
EPSS Percentile	96th Percentile
Exploit Status	PoC Available
Impact	Confidentiality, Integrity, Availability