CVE-2025-24893
Published: 20 February 2025
Summary
CVE-2025-24893 is a critical-severity Eval Injection (CWE-95) vulnerability in Xwiki Xwiki. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 0.2% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 CM-6 (Configuration Settings) and SI-10 (Information Input Validation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates this RCE vulnerability by requiring timely patching to fixed XWiki versions 15.10.11, 16.4.1, or 16.5.0RC1.
Prevents SSTI exploitation by validating user-supplied 'text' input in SolrSearch RSS requests to block malicious Groovy payloads.
Secures SolrSearchMacros configuration to enforce application/xml content type per workaround, preventing direct feed output and code execution.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is a remote unauthenticated RCE in the public-facing XWiki SolrSearch component via server-side template injection (Groovy), directly matching exploitation of public-facing applications.
NVD Description
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any guest can perform arbitrary remote code execution through a request to `SolrSearch`. This impacts the confidentiality, integrity and availability of the whole…
more
XWiki installation. To reproduce on an instance, without being logged in, go to `<host>/xwiki/bin/get/Main/SolrSearch?media=rss&text=%7D%7D%7D%7B%7Basync%20async%3Dfalse%7D%7D%7B%7Bgroovy%7D%7Dprintln%28"Hello%20from"%20%2B%20"%20search%20text%3A"%20%2B%20%2823%20%2B%2019%29%29%7B%7B%2Fgroovy%7D%7D%7B%7B%2Fasync%7D%7D%20`. If there is an output, and the title of the RSS feed contains `Hello from search text:42`, then the instance is vulnerable. This vulnerability has been patched in XWiki 15.10.11, 16.4.1 and 16.5.0RC1. Users are advised to upgrade. Users unable to upgrade may edit `Main.SolrSearchMacros` in `SolrSearchMacros.xml` on line 955 to match the `rawResponse` macro in `macros.vm#L2824` with a content type of `application/xml`, instead of simply outputting the content of the feed.
Deeper analysisAI
CVE-2025-24893 is a critical remote code execution vulnerability in the XWiki Platform, a generic wiki platform providing runtime services for applications. The flaw resides in the SolrSearch component, where insufficient validation of user-supplied input in RSS media requests allows arbitrary code execution via server-side template injection. Specifically, unauthenticated attackers can exploit the `SolrSearch` endpoint by crafting a request such as `/xwiki/bin/get/Main/SolrSearch?media=rss&text=%7D%7D%7D%7B%7Basync%20async%3Dfalse%7D%7D%7B%7Bgroovy%7D%7Dprintln%28"Hello%20from"%20%2B%20"%20search%20text%3A"%20%2B%20%2823%20%2B%2019%29%29%7B%7B%2Fgroovy%7D%7D%7B%7B%2Fasync%7D%7D`, resulting in Groovy code execution if the RSS feed title reflects the output "Hello from search text:42". This issue is associated with CWE-94 and CWE-95, carrying a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Any unauthenticated guest user can exploit this vulnerability remotely over the network with low complexity, requiring no privileges or user interaction. Successful exploitation grants full control over the affected XWiki instance, compromising confidentiality, integrity, and availability through arbitrary code execution on the server.
XWiki has addressed the vulnerability in versions 15.10.11, 16.4.1, and 16.5.0RC1, with users advised to upgrade immediately. For those unable to upgrade, a workaround involves editing `Main.SolrSearchMacros` in `SolrSearchMacros.xml` at line 955 to align with the `rawResponse` macro in `macros.vm` at line 2824, enforcing a content type of `application/xml` instead of directly outputting feed content. Detailed patch information is available in the XWiki security advisory (GHSA-rr6p-3pfg-562j) and related GitHub commit.
Details
- CWE(s)
- KEV Date Added
- 30 October 2025