CVE-2025-24893 | Remote code execution as guest via SolrSearchMacros request in xwiki

Exp

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any guest can perform arbitrary remote code execution through a request to `SolrSearch`. This impacts the confidentiality, integrity and availability of the whole XWiki installation. To reproduce on an instance, without being logged in, go to `<host>/xwiki/bin/get/Main/SolrSearch?media=rss&text=%7D%7D%7D%7B%7Basync%20async%3Dfalse%7D%7D%7B%7Bgroovy%7D%7Dprintln%28"Hello%20from"%20%2B%20"%20search%20text%3A"%20%2B%20%2823%20%2B%2019%29%29%7B%7B%2Fgroovy%7D%7D%7B%7B%2Fasync%7D%7D%20`. If there is an output, and the title of the RSS feed contains `Hello from search text:42`, then the instance is vulnerable. This vulnerability has been patched in XWiki 15.10.11, 16.4.1 and 16.5.0RC1. Users are advised to upgrade. Users unable to upgrade may edit `Main.SolrSearchMacros` in `SolrSearchMacros.xml` on line 955 to match the `rawResponse` macro in `macros.vm#L2824` with a content type of `application/xml`, instead of simply outputting the content of the feed.

Published: 2025-02-20 Last update: 2026-06-17 Assigner: [email protected] Source: [email protected]
NVD Status：Analyzed，CVE State: published
View at NVD, CVE.org, EUVD

CVE-2025-24893 is rated Critical Active Threat (100/100): CVSS Critical severity, with high exploitation likelihood (EPSS 99.90%, 100th percentile). CISA KEV confirms active exploitation (added 2025-10-30) affecting XWiki / Platform. a weakness (CWE-94) Unauthenticated remote administrative access may be possible. EPSS rose +6.24% over the last day, indicating growing attacker interest. The CISA remediation deadline has passed—treat as an emergency patch priority.

Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.

CISA KEV Record for CVE-2025-24893

Name: XWiki Platform Eval Injection Vulnerability · CISA KEV detail

Exploit added: 2025-10-30

Action due: 2025-11-20

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Public exploit references (Exploit-DB) for CVE-2025-24893

EDB-ID Source Kind Published Link
52429 exploit_db edb 2025-09-16 Exploit-DB ↗
52136 exploit_db edb 2025-04-07 Exploit-DB ↗
— nvd_ref exploit_tag Exploit-DB ↗

Exploit prediction scoring system (EPSS) score for CVE-2025-24893

EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).

# Date Old EPSS score New EPSS score Delta (New - Old)
1 2026-06-15 93.66% 99.90% +6.24%
2 2026-06-10 93.84% 93.66% -0.18%
3 2026-06-08 — 93.84% —

Full EPSS history (42 records total)

Common vulnerability scoring system (CVSS) metrics for CVE-2025-24893

CVSS metrics for this CVE.

Base score Version Severity Vector Exploitability Impact Score source
9.8 3.1 CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Click to expand
Attack vector (AV:N)
Could be attacked over the internet or any normal routed network—not just someone sitting at the machine.
Attack complexity (AC:L)
Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup.
Privileges required (PR:N)
No account or special rights needed—anonymous or random user is enough.
User interaction (UI:N)
Nobody has to click “OK” or open a trap file; it can work without a victim helping.
Scope (S:U)
Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems.
Confidentiality (C:H)
Serious risk that confidential data gets exposed in a big way.
Integrity (I:H)
They could widely tamper with or forge data—trust in the data is badly hurt.
Availability (A:H)
Could take the service down hard or make it unusable for people who depend on it.
 3.9 5.9 [email protected]
9.8 3.1 CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Click to expand
Attack vector (AV:N)
Could be attacked over the internet or any normal routed network—not just someone sitting at the machine.
Attack complexity (AC:L)
Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup.
Privileges required (PR:N)
No account or special rights needed—anonymous or random user is enough.
User interaction (UI:N)
Nobody has to click “OK” or open a trap file; it can work without a victim helping.
Scope (S:U)
Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems.
Confidentiality (C:H)
Serious risk that confidential data gets exposed in a big way.
Integrity (I:H)
They could widely tamper with or forge data—trust in the data is badly hurt.
Availability (A:H)
Could take the service down hard or make it unusable for people who depend on it.
 3.9 5.9 [email protected]

Weakness enumeration for CVE-2025-24893

GitHub Security Advisory for CVE-2025-24893

GHSA-rr6p-3pfg-562j · Severity: critical · Ecosystem: maven — XWiki Platform allows remote code execution as guest via SolrSearchMacros request

Affected software / configurations for CVE-2025-24893

Vendor Product Version Raw CPE
xwiki xwiki >= 5.4, < 15.10.11 cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*
xwiki xwiki >= 16.0.0, < 16.4.1 cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*
xwiki xwiki 5.3 cpe:2.3:a:xwiki:xwiki:5.3:-:*:*:*:*:*:*
xwiki xwiki 5.3 cpe:2.3:a:xwiki:xwiki:5.3:milestone2:*:*:*:*:*:*
xwiki xwiki 5.3 cpe:2.3:a:xwiki:xwiki:5.3:rc1:*:*:*:*:*:*

References for CVE-2025-24893

URL Tags
https://github.com/xwiki/xwiki-platform/blob/568447cad5172d97d6bbcfda9f6183689c2cf086/xwiki-platform-core/xwiki-platform-search/xwiki-platform-search-solr/xwiki-platform-search-solr-ui/src/main/resources/Main/SolrSearchMacros.xml#L955 Product
https://github.com/xwiki/xwiki-platform/blob/67021db9b8ed26c2236a653269302a86bf01ef40/xwiki-platform-core/xwiki-platform-web/xwiki-platform-web-templates/src/main/resources/templates/macros.vm#L2824 Product
https://github.com/xwiki/xwiki-platform/commit/67021db9b8ed26c2236a653269302a86bf01ef40 Patch
https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-rr6p-3pfg-562j Vendor Advisory
https://jira.xwiki.org/browse/XWIKI-22149 Exploit Issue Tracking Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-24893 US Government Resource
cvelogic Threat Intelligence