CVE-2025-24893 KEVPublic exploit Critical · 9.8 EPSS >99.9%

XWiki Platform Eval Injection Vulnerability

XWiki · Platform

Summary

An eval injection flaw in the Platform component of XWiki (its Solr search handling via the SolrSearch endpoint) lets an unauthenticated guest inject template directives that are dynamically evaluated. An attacker needs only network access to a vulnerable instance, with no authentication or user interaction, to execute arbitrary code on the whole XWiki installation.

Official description · NVD

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any guest can perform arbitrary remote code execution through a request to `SolrSearch`. This impacts the confidentiality, integrity and availability of the whole XWiki installation. To reproduce on an instance, without being logged in, go to `<host>/xwiki/bin/get/Main/SolrSearch?media=rss&text=%7D%7D%7D%7B%7Basync%20async%3Dfalse%7D%7D%7B%7Bgroovy%7D%7Dprintln%28"Hello%20from"%20%2B%20"%20search%20text%3A"%20%2B%20%2823%20%2B%2019%29%29%7B%7B%2Fgroovy%7D%7D%7B%7B%2Fasync%7D%7D%20`. If there is an output, and the title of the RSS feed contains `Hello from search text:42`, then the instance is vulnerable. This vulnerability has been patched in XWiki 15.10.11, 16.4.1 and 16.5.0RC1. Users are advised to upgrade. Users unable to upgrade may edit `Main.SolrSearchMacros` in `SolrSearchMacros.xml` on line 955 to match the `rawResponse` macro in `macros.vm#L2824` with a content type of `application/xml`, instead of simply outputting the content of the feed.

Breakdown

69.9 / 100

Exploited: Yes, in CISA KEV
Reports: 0
Tactics: 2/15

How an attack unfolds

Based on mappings. Select a step to see the evidence.

How attackers get in
- Break in through an internet-facing appT1190 · Exploit Public-Facing ApplicationAI-written (claude-haiku-5-5)Medium confidence149 general detection rules
What they do
- Run commands on the systemT1059 · Command and Scripting InterpreterAI-written (claude-haiku-5-5)Medium confidence95 general detection rules

First seen exploited 27 days after disclosure. Public exploit code (Metasploit) was available the same day.

DisclosedPublic exploit codeMetasploit20 Feb 2025day 0
First seen exploitedVulnCheck KEV evidence19 Mar 2025+27 days
Added to CISA KEVEU database agrees30 Oct 2025+8 mo

CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.

See the family tree

4 related vulnerabilities in the same code over 22 months. The latest fix listed for xwiki-platform-search-solr-ui is 16.4.1.

Same bug familyLinked by evidence that a fix failed or the same code was patched again. Oldest first.

CVE-2023-29207Improper Neutralization of Script-Related HTML Tags (XSS) in the…15 Apr 2023
same family
CVE-2023-36469Code injection through NotificationRSSService in XWiki Platform29 Jun 2023
same family
CVE-2024-31982XWiki Platform: Remote code execution as guest via…10 Apr 2024
relatedMedium
Why these are linked:
- Same code patched: DatabaseSearch.xml (machine-matched)commit 3c9e4bb commit 459e968 commit 67021db
This CVECVE-2025-24893XWiki Platform Eval Injection20 Feb 2025KEV

Fixes in xwiki-platform-search-solr-uiMaven package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

15.10-rc-1CVE-2024-3198410 Apr 2024
16.4.1CVE-2025-2489320 Feb 2025KEVLatest listed

techniques

2 , grouped by in kill-chain order, 2 cited passages 2

Initial AccessTA0001

Exploit Public-Facing Application T1190 Medium

AI mapping from the description · how it is exploited

unauthenticated request to public web endpoint

Any guest can perform arbitrary remote code execution through a request to `SolrSearch`

From the official description (NVD) Original ↗

ExecutionTA0002

Command and Scripting Interpreter T1059 Medium

AI mapping from the description · primary impact

Groovy code executes server-side

arbitrary remote code execution through a request to

From the official description (NVD) Original ↗

Detection

0 rules for this CVE · 244 general rules for its techniques

Rules for this CVE

0 that reference CVE-2025-24893 directly.

CVE-specific rules are not available in this build. Search SigmaHQ ↗

General rules for this CVE’s techniques

These detect the technique in general, not this specific vulnerability.

Exploit Public-Facing ApplicationT1190149 general rules

Arcadyan Router Exploitationscriticaltest
Citrix ADS Exploitation CVE-2020-8193 CVE-2020-8195criticaltest
Citrix Netscaler Attack CVE-2019-19781criticaltest
Confluence Exploitation CVE-2019-3398criticaltest
CVE-2010-5278 Exploitation Attemptcriticaltest
CVE-2020-0688 Exchange Exploitation via Web Logcriticaltest
CVE-2020-10148 SolarWinds Orion API Auth Bypasscriticaltest
CVE-2020-5902 F5 BIG-IP Exploitation Attemptcriticaltest

All 149 on SigmaHQ ↗

Command and Scripting InterpreterT105995 general rules

HackTool - Sliver C2 Implant Activity Patterncriticaltest
Lazarus Group Activitycriticaltest
REvil Kaseya Incident Malware Patternscriticaltest
Turla Group Lateral Movementcriticaltest
Windows Defender AMSI Trigger Detectedhighstable
Windows Defender Threat Detectedhighstable
Abusable DLL Potential Sideloading From Suspicious Locationhightest
Add Insecure Download Source To Wingethightest

All 95 on SigmaHQ ↗

Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

1 package in 1 ecosystem. Main package: org.xwiki.platform:xwiki-platform-search-solr-ui.

Mavenorg.xwiki.platform:xwiki-platform-search-solr-uiGHSA-rr6p-3pfg-562j

Upgrade to 16.4.1 or later

Set the version to 16.4.1 or later in your pom.xml or build.gradle.

The first fix for CVE-2025-24893.

Affected versions, by release line

If you run	Upgrade to
16.0.0-rc-1 up to 16.4.1	16.4.1
5.3-milestone-2 up to 15.10.11	15.10.11

“Up to” means the second version is the fix and is not affected.

Check your lockfile against all CVEs

What security researchers reported

Not named in any threat report yet

Also mentioned in 50 community threat pulses (AlienVault OTX)

Weaker evidence

Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.

Actively_Exploited_Kev | Oct 30, 202629 Oct 2026
Actively_Exploited_Kev | Oct 29, 202628 Oct 2026
Actively_Exploited_Kev | Oct 28, 202627 Oct 2026
Actively_Exploited_Kev | Oct 27, 202626 Oct 2026
Actively_Exploited_Kev | Oct 24, 202623 Oct 2026
Actively_Exploited_Kev | Oct 23, 202622 Oct 2026
44 more on OTX

References

6 links, grouped by NVD tag

Exploitation evidence

Exploited in the wild

Listed since 30 Oct 2025. Federal due date 20 Nov 2025. No recorded ransomware use.

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

ENISA

Marked exploited since 30 Oct 2025. EUVD-2025-4562

XWiki Platform 15.10.10 - Remote Code ExecutionEDB-52136 · webapps · multiple · 2025-04-07
XWiki Platform 15.10.10 - Metasploit Module for Remote Code Execution (RCE)EDB-52429 · webapps · multiple · 2025-09-16

, 30 Oct 2026

>99.9%Top 0.02%

Chance of exploitation in the next 30 days. of scored CVEs (riskier than 99.98%).

3.1

9.8Critical · 9.8

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Priority factorsFormula

In a KEV cataloglisted in CISA KEV and VulnCheck KEV 35.0/35

Recent KEV listingadded 591 days ago 0.0/10

Known ransomware usenot known 0.0/10

EPSS percentilepercentile 0.9998 20.0/20

Threat reports0 reports 0.0/10

Public exploit code1 NVD reference tagged Exploit; 2 Exploit-DB entries; 37 PoC-in-GitHub repos; 1 Metasploit module; 1 nuclei template 5.0/5

Mentioned in OTX pulses50 pulses 3.0/3

CVSS base scorebase score 9.8 6.9/7

End-of-life productsupported or unknown 0.0

Total69.9

Record

Published: 20 Feb 2025
Modified: 17 Jun 2026
: CWE-94 Improper Control of Generation of CodeCWE-95 Improper Neutralization of Directives in Dynamically Evaluated Code
Elsewhere: NVD CVE.org KEV JSON

How an attack unfolds

1How attackers get in

2What they do

Exploitation timelineExploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.

Patch historyPatch historyEarlier and later CVEs in the same code, in date order. It shows when a fix was bypassed or incomplete and which version finally fixed it.

Same bug familyLinked by evidence that a fix failed or the same code was patched again. Oldest first.

Fixes in xwiki-platform-search-solr-uiMaven package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

ATT&CKMITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques

Initial AccessTA0001

ExecutionTA0002

Detection

Rules for this CVE

General rules for this CVE’s techniques

Am I affected? What do I upgrade to?

Affected versions, by release line

What security researchers reported

Also mentioned in 50 community threat pulses (AlienVault OTX)

References

Vendor Advisory 2

Patch 1

US Government Resource 1

Product 2

How attackers get in

What they do

techniques