WaratekVRT Sign in

CVE-2025-24893 XWiki

Affected softwareXWiki
Severity9.8 Critical CVSS 3.1 2 scores
Fixed in15.10.11, 16.4.1
WeaknessCode injection (CWE-94)
Published20 Feb 2025
Updated29 Sep 2026

Description

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any guest can perform arbitrary remote code execution through a request to SolrSearch. This impacts the confidentiality, integrity and availability of the whole XWiki installation. To reproduce on an instance, without being logged in, go to <host>/xwiki/bin/get/Main/SolrSearch?media=rss&text=%7D%7D%7D%7B%7Basync%20async%3Dfalse%7D%7D%7B%7Bgroovy%7D%7Dprintln%28"Hello%20from"%20%2B%20"%20search%20text%3A"%20%2B%20%2823%20%2B%2019%29%29%7B%7B%2Fgroovy%7D%7D%7B%7B%2Fasync%7D%7D%20. If there is an output, and the title of the RSS feed contains Hello from search text:42, then the instance is vulnerable. This vulnerability has been patched in XWiki 15.10.11, 16.4.1 and 16.5.0RC1. Users are advised to upgrade. Users unable to upgrade may edit Main.SolrSearchMacros in SolrSearchMacros.xml on line 955 to match the rawResponse macro in macros.vm#L2824 with a content type of application/xml, instead of simply outputting the content of the feed.

CWE-95

Exploitation status

Exploited

Confirmed real-world exploitation.
  • CISA KEV listed Confirmed exploitation in the wild. Added 2025-10-30 · remediation due 2025-11-20 · ransomware use: unknown
  • VulnCheck KEV listed Exploitation reported in the wild. 12 citations · honeypot sightings · 50 exploits · earliest 2025-03-19.
  • CISA Vulnrichment exploitation: active CISA records active exploitation. Automatable: yes, technical impact: total.
  • Indexed PoC 41 indexed Published artifacts you can open, in Exploit-DB, GitHub PoC, Metasploit, Nuclei; first seen 2025-02-25.
  • EPSS 99.9% chance in 30 days A model's forecast, not a report of exploitation. Higher than 99.9% of all scored CVEs.

VulnCheck KEV

Exploitation evidence from VulnCheck Known Exploited Vulnerabilities (VulnCheck KEV), used under VulnCheck's community terms. View CVE-2025-24893 in VulnCheck (free account), which lists 7 more citations and 45 more exploit references not shown here.

EvidenceSourceDetailDate
Honeypot sighting Shadowserver honeypots Exploitation attempts seen on 347 days 2025-04-20 to 2026-11-11
Honeypot sighting VulnCheck canaries Exploitation attempts seen on 311 days 2025-10-17 to 2026-11-13
Reported exploitation cyble.com /blog/cyble-sensors-detect-exploit-attempts-on-ivanti-avtech-ip-cameras 2025-03-19
Reported exploitation app.crowdsec.net /cti/cve-explorer/CVE-2025-24893 2025-06-07
Reported exploitation vulncheck.com /blog/xwiki-cve-2025-24893-eitw 2025-10-28
Reported exploitation cisa.gov /sites/default/files/feeds/known_exploited_vulnerabilities.json 2025-10-30
Reported exploitation isc.sans.edu /diary/32444 2025-11-03
Exploit reference VulnCheck XDB 5855609e4d40 Exploit type: initial-access 2025-02-25
Exploit reference VulnCheck XDB 6d2a0b82c683 Exploit type: initial-access 2025-02-25
Exploit reference VulnCheck XDB e8a608a67a7e Exploit type: initial-access 2025-05-05
Exploit reference VulnCheck XDB 3e5b42bc93c5 Exploit type: initial-access 2025-06-06
Exploit reference VulnCheck XDB 1b13eb840965 Exploit type: initial-access 2025-08-03
IndexArtifactStarsFirst seen
GitHub PoC PoC for CVE-2025-24893: XWiki' Remote Code Execution exploit for versions prior to 15.10.11, 16.4.1 and 16.5.0RC1. 23 2025-08-04
Nuclei XWiki Platform - Remote Code Execution
Exploit-DB XWiki Platform 15.10.10 - Metasploit Module for Remote Code Execution (RCE) 2025-09-16
Metasploit Remote Code Execution Vulnerability in XWiki Platform (CVE-2025-24893) (excellent rank)
GitHub PoC CVE-2025-24893 is a critical unauthenticated remote code execution vulnerability in XWiki (versions < 15.10.11, 16.4.1, 16.5.0RC1) caused by improper handling of Groovy expressions in the SolrSearch macro. 17 2025-08-04
Exploit-DB XWiki Platform 15.10.10 - Remote Code Execution 2025-04-07
GitHub PoC b0ySie7e/CVE-2025-24893 11 2025-09-03
GitHub PoC XWiki SolrSearchMacros 远程代码执行漏洞PoC（CVE-2025-24893） 10 2025-02-25
GitHub PoC This vulnerability could allow a malicious user to execute remote code by sending appropriately crafted requests to the default search engine SolrSearch 6 2025-08-08
GitHub PoC PoC exploits CVE-2025-24893 , a remote code execution (RCE) vulnerability in XWiki caused by improper sandboxing in Groovy macros rendered asynchronously. It allows arbitrary command execution through injection into RSS-based SolrSearch endpoints. 6 2025-08-03

Waratek protection

Protected by Waratek

Waratek has a rule that blocks attacks on this vulnerability.

Decided by A researcher's recorded decision for this specific CVE
Finding A researcher found this CVE protected by the ARMR Process rule.

Waratek research note

written 2026-11-13

Written by a Waratek engineer who reviewed this CVE. Their decision sets the status above, ahead of every automated rule except a withdrawal.

Comments

Rule Name: ARMR Process rule

Unauthenticated Groovy macro injection via the SolrSearch RSS text parameter; the Process rule (with /bin/* and /usr/bin/* listed) blocks the execute()/ProcessBuilder fork every public exploit uses. A Groovy script that reads files or wiki data directly in Java, without starting a program, is not stopped.

How to mitigate CVE-2025-24893

Upgrade XWiki to a release that fixes it: 15.10.11 or 16.4.1. Until you can, Waratek RASP blocks exploitation with its process rule. It runs inside the Java application, with no code changes.

Waratek RASP Runtime protection for Java applications

CVSS

9.8 CRITICAL v3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 2 metrics

We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.

VersionScoreBandVectorAssignerType
CVSS 3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H security-advisories@github.com Secondary published
CVSS 3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H NVD Primary

Affected software and releases

Maven packages

Affected and fixed versions, from OSV.dev
PackageIntroducedFixedLast affected
org.xwiki.platform:xwiki-platform-search-solr-ui 5.3-milestone-2 15.10.11 unbounded
org.xwiki.platform:xwiki-platform-search-solr-ui 16.0.0-rc-1 16.4.1 unbounded

Products and versions

2 products, 7 version entries
SourceVendorProductSchemeAffected versions
osv org.xwiki.platform xwiki-platform-search-solr-ui generic ≥ 5.3 and ＜ 15.10.11 · ≥ 16.0.0 and ＜ 16.4.1
nvd xwiki xwiki generic 5.3 · 5.3:milestone2 · 5.3:rc1 · ≥ 5.4 and ＜ 15.10.11 · ≥ 16.0.0 and ＜ 16.4.1

References

URLTags
https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-rr6p-3pfg-562j WEB
https://github.com/xwiki/xwiki-platform/commit/67021db9b8ed26c2236a653269302a86bf01ef40 WEB
https://github.com/xwiki/xwiki-platform PACKAGE
https://github.com/xwiki/xwiki-platform/blob/568447cad5172d97d6bbcfda9f6183689c2cf086/xwiki-platform-core/xwiki-platform-search/xwiki-platform-search-solr/xwiki-platform-search-solr-ui/src/main/resources/Main/SolrSearchMacros.xml#L955 WEB
https://github.com/xwiki/xwiki-platform/blob/67021db9b8ed26c2236a653269302a86bf01ef40/xwiki-platform-core/xwiki-platform-web/xwiki-platform-web-templates/src/main/resources/templates/macros.vm#L2824 WEB
https://jira.xwiki.org/browse/XWIKI-22149 WEB
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-24893 WEB

Timeline
Published2025-02-20By the CVE Program.
VulnCheck KEV: earliest evidence2025-03-19Date of the oldest evidence of exploitation in VulnCheck KEV's record. VulnCheck does not publish the date it listed the CVE.
Added to CISA KEV2025-10-30Listed in CISA's Known Exploited Vulnerabilities catalog.
NVD record modified2026-06-17NVD's own last-modified date for this record.
Last VRT activity2026-09-29Most recent commit touching this CVE's classification, patch or rule file.
VulnCheck KEV: latest evidence2026-11-13Date of the newest report, exploit reference or honeypot sighting in VulnCheck KEV's record.
Classification created2026-11-13First commit adding this CVE's research note.