CVE-2025-24893

Published Feb 20, 2025

Last updated 5 months ago

Exploit known CVSS critical 9.8

XWiki Platform

Overview

Description: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any guest can perform arbitrary remote code execution through a request to `SolrSearch`. This impacts the confidentiality, integrity and availability of the whole XWiki installation. To reproduce on an instance, without being logged in, go to `<host>/xwiki/bin/get/Main/SolrSearch?media=rss&text=%7D%7D%7D%7B%7Basync%20async%3Dfalse%7D%7D%7B%7Bgroovy%7D%7Dprintln%28"Hello%20from"%20%2B%20"%20search%20text%3A"%20%2B%20%2823%20%2B%2019%29%29%7B%7B%2Fgroovy%7D%7D%7B%7B%2Fasync%7D%7D%20`. If there is an output, and the title of the RSS feed contains `Hello from search text:42`, then the instance is vulnerable. This vulnerability has been patched in XWiki 15.10.11, 16.4.1 and 16.5.0RC1. Users are advised to upgrade. Users unable to upgrade may edit `Main.SolrSearchMacros` in `SolrSearchMacros.xml` on line 955 to match the `rawResponse` macro in `macros.vm#L2824` with a content type of `application/xml`, instead of simply outputting the content of the feed.
Source: security-advisories@github.com
NVD status: Analyzed
Products: xwiki

Risk scores

CVSS 3.1

Type: Primary
Base score: 9.8
Impact score: 5.9
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity: CRITICAL

Known exploits

Data from CISA

Vulnerability name: XWiki Platform Eval Injection Vulnerability
Exploit added on: Oct 30, 2025
Exploit action due: Nov 20, 2025
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Weaknesses

security-advisories@github.com: CWE-95
nvd@nist.gov: CWE-94

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "A9F2AD2E-CF5D-46D1-AFB8-2E9529C8E8D4",
            "versionEndExcluding": "15.10.11",
            "versionStartIncluding": "5.4",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "5921C493-2A56-49BC-8763-7D12518C0DC2",
            "versionEndExcluding": "16.4.1",
            "versionStartIncluding": "16.0.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:xwiki:xwiki:5.3:-:*:*:*:*:*:*",
            "matchCriteriaId": "F5CC1FB7-2BAD-4413-9955-02E06BA27305",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:xwiki:xwiki:5.3:milestone2:*:*:*:*:*:*",
            "matchCriteriaId": "067AAD11-1AB2-4688-8D81-F2464CD2FA14",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:xwiki:xwiki:5.3:rc1:*:*:*:*:*:*",
            "matchCriteriaId": "F2FCE7B4-E701-4C07-B4A9-31EC6C25F882",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.

Overview

Risk scores

CVSS 3.1

Known exploits

Weaknesses

Social media

Configurations

Related CVEs

References