CVE-2025-24893

CRITICAL
2025-02-20 [email protected]
9.8
CVSS 3.1
Share

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Mar 28, 2026 - 18:27 vuln.today
Patch Released
Mar 28, 2026 - 18:27 nvd
Patch available
Added to CISA KEV
Oct 31, 2025 - 13:17 cisa
CISA KEV
PoC Detected
Oct 31, 2025 - 13:17 vuln.today
Public exploit code
CVE Published
Feb 20, 2025 - 20:15 nvd
CRITICAL 9.8

Tags

RCE Code Injection Xwiki

Description

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any guest can perform arbitrary remote code execution through a request to `SolrSearch`. This impacts the confidentiality, integrity and availability of the whole XWiki installation. To reproduce on an instance, without being logged in, go to `<host>/xwiki/bin/get/Main/SolrSearch?media=rss&text=%7D%7D%7D%7B%7Basync%20async%3Dfalse%7D%7D%7B%7Bgroovy%7D%7Dprintln%28"Hello%20from"%20%2B%20"%20search%20text%3A"%20%2B%20%2823%20%2B%2019%29%29%7B%7B%2Fgroovy%7D%7D%7B%7B%2Fasync%7D%7D%20`. If there is an output, and the title of the RSS feed contains `Hello from search text:42`, then the instance is vulnerable. This vulnerability has been patched in XWiki 15.10.11, 16.4.1 and 16.5.0RC1. Users are advised to upgrade. Users unable to upgrade may edit `Main.SolrSearchMacros` in `SolrSearchMacros.xml` on line 955 to match the `rawResponse` macro in `macros.vm#L2824` with a content type of `application/xml`, instead of simply outputting the content of the feed.

Analysis

XWiki Platform allows unauthenticated remote code execution through the SolrSearch endpoint, enabling guests to execute arbitrary code and compromise the entire XWiki installation.

Technical Context

The CWE-95 eval injection in XWiki's SolrSearch page processes user input through the wiki's scripting engine without proper sanitization. Crafted search requests are evaluated as Groovy code, enabling arbitrary command execution on the server.

Affected Products

['XWiki Platform (affected versions)']

Remediation

Apply XWiki security updates. Restrict guest access to XWiki. Disable the SolrSearch feature if not required.

Priority Score

213
Low Medium High Critical
KEV: +50
EPSS: +93.9
CVSS: +49
POC: +20

Share

CVE-2025-24893 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy