critical9.8Known exploitedPublic exploit code
CVE-2025-24893
XWiki Platform allows remote code execution as guest via SolrSearchMacros request
Exploited in the wild
This vulnerability is on the CISA Known Exploited Vulnerabilities list, added 2025-10-30. Federal due date: 2025-11-20.
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- XWiki Platform 15.10.10 - Metasploit Module for Remote Code Execution (RCE)2025-09-16 · webapps · multiple
- XWiki Platform 15.10.10 - Remote Code Execution2025-04-07 · webapps · multiple
Impact
XWiki Platform contains an eval injection vulnerability that could allow any guest to perform arbitrary remote code execution through a request to SolrSearch.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.xwiki.platform:xwiki-platform-search-solr-ui | >= 5.3-milestone-2, < 15.10.11 | 15.10.11 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Xwiki | Xwiki | from 5.4 before 15.10.11 from 16.0.0 before 16.4.1 Version 5.3 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- CISA KEV catalog
- https://github.com/xwiki/xwiki-platform/blob/568447cad5172d97d6bbcfda9f6183689c2cf086/xwiki-platform-core/xwiki-platform-search/xwiki-platform-search-solr/xwiki-platform-search-solr-ui/src/main/resources/Main/SolrSearchMacros.xml#L955
- https://github.com/xwiki/xwiki-platform/blob/67021db9b8ed26c2236a653269302a86bf01ef40/xwiki-platform-core/xwiki-platform-web/xwiki-platform-web-templates/src/main/resources/templates/macros.vm#L2824
- https://github.com/xwiki/xwiki-platform/commit/67021db9b8ed26c2236a653269302a86bf01ef40
- https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-rr6p-3pfg-562j
- https://jira.xwiki.org/browse/XWIKI-22149
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-24893
- https://github.com/advisories/GHSA-rr6p-3pfg-562j
- https://nvd.nist.gov/vuln/detail/CVE-2025-24893