CVE-2024-56158 is a critical severity SQL injection flaw (CVSS 9.8) in XWiki. On Oracle databases, the query validator does not block native functions, so any SQL query can run. The fixed versions are 16.10.2, 16.4.7 and 15.10.16, and the advisory lists no workaround other than upgrading.
What's affected
The GitHub advisory GHSA-prwh-7838-xf82 is titled SQL injection in query endpoint of REST API with Oracle. It lists the Maven package org.xwiki.platform:xwiki-platform-oldcore with affected versions of 1.0 and later, and these patched versions:
- 16.10.2
- 16.4.7
- 15.10.16
The advisory text describes the issue as affecting installations that use Oracle as the database. If you run XWiki on another database, the described attack path does not apply in the same way, but you should still upgrade, since the fix is in shared query validation code. Note that the prose in the advisory mentions 16.10.1 and 16.4.6 as patched, while the patched versions field and the NVD record give 16.10.2 and 16.4.7. Use the later numbers.
How to check if you're exposed
Check the XWiki version from the administration page, or from the footer of the default skin. If you deploy through a build tool, look for the affected artifact in your dependency tree:
mvn dependency:tree | grep xwiki-platform-oldcore
Next, confirm which database you use. In a standard install the database connection is set in hibernate.cfg.xml, and the connection URL shows whether it is Oracle.
Then ask whether the query endpoint of the REST API can be reached by people who should not have access. The vector in the record shows no privileges required, which means you should assume anonymous access unless your configuration says otherwise.
What to do now
- Identify every XWiki instance, including test and documentation sites that have been forgotten.
- Upgrade to 16.10.2, 16.4.7 or 15.10.16, whichever matches your release line. The advisory says there is no known workaround.
- If you cannot upgrade today, restrict access to the wiki's REST API at the reverse proxy to trusted networks, as a stop gap rather than a fix.
- Review the database account XWiki uses and reduce its rights to the least it needs.
- Search access logs for unusual use of the query endpoint from before the upgrade.
- Rotate any credentials stored in the wiki database if you find signs of abuse.
Why it matters
This is CWE-89, SQL injection, in an unusual place. XWiki lets people write queries in HQL, the Hibernate query language, and it has a validator that is meant to allow safe selects and block anything dangerous. The advisory explains the gap. The validator does not sanitize functions used in a simple select, and Hibernate allows any native function to be called from HQL. On Oracle, that includes functions that run SQL text supplied as a string.
So the validator was checking the shape of the query while the database was willing to run far more than the shape suggested. This is a recurring pattern with query languages that sit on top of SQL. A filter for dangerous keywords misses the functions that do the same work. The vector in the record shows network access, low complexity and no privileges, with high impact on confidentiality, integrity and availability, which is why it scores 9.8. The KEV flag in the record is false.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does CVE-2024-56158 affect XWiki on other databases?
The advisory describes the issue for Oracle. The fix still ships in the same releases, so upgrade regardless of database.
Is there a workaround?
The advisory says there is no known workaround other than upgrading XWiki. Network restrictions only reduce exposure.
Sources
Last reviewed: 19 October 2026.
