CVE-2025-24893 XWiki Platform Eval Injection

What is CVE-2025-24893?

CVE-2025-24893 is a critical code injection vulnerability in Xwiki Xwiki, published on 20 Feb 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any guest can perform arbitrary remote code execution through a request to `SolrSearch`. This impacts the confidentiality, integrity and availability of the whole XWiki installation. To reproduce on an instance, without being logged in, go to `<host>/xwiki/bin/get/Main/SolrSearch?media=rss&text=%7D%7D%7D%7B%7Basync%20async%3Dfalse%7D%7D%7B%7Bgroovy%7D%7Dprintln%28"Hello%20from"%20%2B%20"%20search%20text%3A"%20%2B%20%2823%20%2B%2019%29%29%7B%7B%2Fgroovy%7D%7D%7B%7B%2Fasync%7D%7D%20`. If there is an output, and the title of the RSS feed contains `Hello from search text:42`, then the instance is vulnerable. This vulnerability has been patched in XWiki 15.10.11, 16.4.1 and 16.5.0RC1. Users are advised to upgrade. Users unable to upgrade may edit `Main.SolrSearchMacros` in `SolrSearchMacros.xml` on line 955 to match the `rawResponse` macro in `macros.vm#L2824` with a content type of `application/xml`, instead of simply outputting the content of the feed.

Weakness: CWE-94, CWE-95

Which versions are affected by CVE-2025-24893?

4 open source packages ship an affected version, including org.xwiki.platform:xwiki-platform-search-solr-ui. It affects 1 product.

Products include Xwiki Xwiki.

How do I fix CVE-2025-24893?

Upgrade org.xwiki.platform:xwiki-platform-search-solr-ui to a fixed version for your release line: 16.4.1 or 15.10.11. US federal agencies must fix it by 20 Nov 2025.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2025-24893 being exploited?

Yes. Attackers have exploited CVE-2025-24893 in the wild since at least 30 Oct 2025.

Public exploit code: 1 Metasploit module, 2 Exploit-DB entries, 1 Nuclei template and 45 proofs of concept on GitHub.

Other vulnerabilities in Xwiki Xwiki

• CVE-2025-53836 XWiki Rendering is vulnerable to RCE attacks when processing nested macros Critical 10.0
• CVE-2024-55662 XWiki allows remote code execution through the extension sheet Critical 10.0
• CVE-2024-55877 XWiki allows remote code execution from account through macro descriptions and XWiki.XWikiSyntaxMacrosList Critical 10.0
• CVE-2024-37901 XWiki Platform vulnerable to remote code execution from account via SearchSuggestConfigSheet Critical 10.0
• CVE-2024-38369 XWiki programming rights may be inherited by inclusion Critical 10.0

All Xwiki Xwiki vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-rr6p-3pfg-562j.