CVE-2025-24893
XWiki Platform Eval Injection Vulnerability
Description
CVE-2025-24893 is a critical remote code execution vulnerability in XWiki Platform with a maximum CVSS v3.1 score of 9.8. The flaw allows any unauthenticated guest user to execute arbitrary code on the XWiki server through a crafted request to the SolrSearch endpoint, completely compromising the confidentiality, integrity, and availability of the entire XWiki installation. Affected versions span from XWiki 5.3 through 16.4.0, with patches available in versions 15.10.11 and 16.4.1. This vulnerability has been added to CISA's Known Exploited Vulnerabilities catalog with a remediation deadline of November 20, 2025. The EPSS score of 0.94241 (99.9th percentile) indicates near-certain active exploitation.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| xwiki | xwiki | >= 5.4, < 15.10.11; >= 16.0.0, < 16.4.1; 5.3 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://github.com/xwiki/xwiki-platform/blob/568447cad5172d97d6bbcfda9f6183689c2cf086/xwiki-platform-core/xwiki-platform-search/xwiki-platform-search-solr/xwiki-platform-search-solr-ui/src/main/resources/Main/SolrSearchMacros.xml#L955(Product)
- https://github.com/xwiki/xwiki-platform/blob/67021db9b8ed26c2236a653269302a86bf01ef40/xwiki-platform-core/xwiki-platform-web/xwiki-platform-web-templates/src/main/resources/templates/macros.vm#L2824(Product)
- https://github.com/xwiki/xwiki-platform/commit/67021db9b8ed26c2236a653269302a86bf01ef40(Patch)
- https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-rr6p-3pfg-562j(Vendor Advisory)
- https://jira.xwiki.org/browse/XWIKI-22149(Exploit, Issue Tracking, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-24893(US Government Resource)
Weakness Type
CWE-95: Eval Injection
CWE-95 describes a vulnerability where an application receives user input and incorporates it into a dynamically evaluated code expression without proper sanitization. In CVE-2025-24893, the XWiki SolrSearch endpoint processes user-supplied parameters in a context where they are evaluated as code, allowing an attacker to inject arbitrary expressions that are executed on the server.
CWE-94: Code Injection
CWE-94 covers the broader category of improper control of code generation, where an application allows user input to influence code that is subsequently executed. Combined with CWE-95, this reflects the XWiki vulnerability's fundamental issue: user-controlled data flowing into a code evaluation context without adequate input validation or output encoding.
Impact Analysis
The business impact of CVE-2025-24893 is catastrophic. Confidentiality, integrity, and availability are all rated as high impact, meaning a successful exploit provides the attacker with complete control over the XWiki installation and its underlying server. XWiki is used as a knowledge management and collaboration platform, so compromising it exposes all stored documents, user credentials, internal communications, and potentially sensitive organizational knowledge.
The exploitation profile makes this one of the most dangerous vulnerabilities in the current threat landscape. The EPSS score of 0.94241 (99.9th percentile) is exceptionally high — only a tiny fraction of all vulnerabilities ever reach this exploitation probability level, indicating massive, ongoing exploitation campaigns. The combination of network accessibility, no authentication requirement, no user interaction, and low attack complexity means exploitation can be fully automated and conducted at scale. Any XWiki instance accessible from the internet is at immediate risk. The vulnerability affects over a decade of XWiki releases, from version 5.3 onward, meaning many long-running installations that may not receive regular updates are vulnerable. Ransomware association is not explicitly listed, but the ability to execute arbitrary code on the server makes ransomware deployment trivially possible, and knowledge bases often contain irreplaceable organizational data that makes them attractive ransomware targets.
Exploit Maturity
CVE-2025-24893 is confirmed as actively exploited in the wild with the highest possible exploitation probability. CISA KEV status: Added to the Known Exploited Vulnerabilities catalog with a mandatory remediation deadline of November 20, 2025. EPSS context: The EPSS score of 0.94241 (99.9th percentile) represents near-certain active exploitation — this is among the most exploited vulnerabilities currently tracked globally.
Public exploit information: The XWiki JIRA issue XWIKI-22149 is tagged as both an exploit reference and a vendor advisory, providing technical details about the vulnerability's exploitation. The XWiki security advisory on GitHub (GHSA-rr6p-3pfg-562j) provides comprehensive information including the vulnerable code paths and patches. The vulnerability is trivially exploitable — it requires only a single HTTP GET request to the SolrSearch endpoint with crafted parameters. Ransomware association: Not explicitly documented, but arbitrary code execution makes any malware deployment possible.
Remediation
-
Upgrade XWiki immediately — Update to XWiki 15.10.11 (for the 15.x LTS branch) or 16.4.1 (for the 16.x branch). Review the XWiki security advisory GHSA-rr6p-3pfg-562j for specific upgrade instructions and the patch commit for technical details.
-
Restrict access to SolrSearch endpoint — As an emergency mitigation before patching, block or restrict access to the SolrSearch endpoint (typically at /xwiki/bin/get/Main/SolrSearch) using your reverse proxy or web application firewall. Block requests containing the media=rss parameter combined with the text parameter.
-
Take XWiki offline if patching is delayed — Given the 99.9th percentile EPSS score and trivial exploitation, any internet-facing XWiki instance that cannot be immediately patched should be taken offline or placed behind VPN access until the update is applied.
-
Perform forensic investigation — If your XWiki instance has been running an affected version while internet-accessible, assume compromise and investigate. Check for unauthorized user accounts, modified wiki pages, unfamiliar file uploads, unexpected system processes, and outbound network connections from the XWiki server.
-
Review and harden XWiki configuration — After patching, review guest access permissions and disable anonymous access to search functionality if not required for your use case. Implement a reverse proxy with request filtering to provide defense-in-depth against future code injection vulnerabilities.
Technical Details
The CVSS v3.1 vector for CVE-2025-24893 is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, producing the near-maximum critical score of 9.8. Every base metric is at its most severe possible value (except Scope), reflecting the extremely dangerous nature of this vulnerability. Attack Vector (Network) means remote exploitation over HTTP. Attack Complexity (Low) means a single crafted request is sufficient. Privileges Required (None) confirms guest-level access is sufficient. User Interaction (None) means no social engineering is needed.
The vulnerability exists in XWiki's SolrSearch functionality, specifically in how the SolrSearchMacros.xml template processes the media=rss output format combined with user-supplied search parameters. When a request is made to the SolrSearch endpoint with the media=rss parameter, the template processes the text parameter through a code evaluation context — specifically XWiki's Velocity template engine and potentially Groovy scripting — without sanitizing the input for code injection payloads. An attacker can inject arbitrary Velocity or Groovy code expressions into the text parameter, which are then evaluated on the server with the full privileges of the XWiki application. The vulnerable code path is visible in the SolrSearchMacros.xml source and the macros.vm template. The exploitation is as simple as navigating to a URL like /xwiki/bin/get/Main/SolrSearch?media=rss&text=[injected code], making automated scanning and exploitation trivially easy. The Scope (Unchanged) metric indicates the impact is within the XWiki application's security context, though in practice, arbitrary code execution typically provides access to the underlying operating system.
Frequently Asked Questions
What is CVE-2025-24893?
CVE-2025-24893 is a critical remote code execution vulnerability in XWiki Platform that allows any unauthenticated user — including anonymous guests — to execute arbitrary code on the XWiki server by sending a crafted request to the SolrSearch endpoint. It carries a CVSS score of 9.8 and has the highest possible EPSS exploitation probability.
How easy is it to exploit this vulnerability?
The vulnerability is trivially exploitable. An attacker only needs to send a single HTTP GET request to the SolrSearch endpoint with specially crafted parameters. No authentication, no user interaction, and no special network position are required. The 99.9th percentile EPSS score confirms massive real-world exploitation.
Which versions of XWiki are affected?
XWiki versions from 5.3 (released over a decade ago) through 15.10.10 and 16.0.0 through 16.4.0 are affected. The fixes are available in versions 15.10.11 and 16.4.1. Given the extremely long range of affected versions, many legacy XWiki installations are likely vulnerable.
What should I do if I cannot patch immediately?
If immediate patching is not possible, you should take the XWiki instance offline or restrict it behind a VPN. At minimum, block access to the SolrSearch endpoint through your reverse proxy or web application firewall. Given the near-certain exploitation probability, leaving an unpatched internet-facing XWiki instance online poses an extreme risk.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.