Code Injection in XWiki platform - CVE-2025-24893
Published: February 24, 2025 / Updated: April 17, 2026
Vulnerability identifier: #VU104143
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2025-24893
CWE-ID: CWE-94
Exploitation vector: Remote access
Exploit availability:
The vulnerability is being exploited in the wild
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to improper input validation within SolrSearchMacros request. A remote attacker can send a specially crafted request and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
Affected software
XWiki platform
How to mitigate CVE-2025-24893
Install updates from vendor's website.
XWiki platform - addressed in versions 15.10.11, 16.4.1
Links to Public Exploits and PoC-codes
- Exploit #12600 - CVE-2025-24893-XWiki-SSTI-RCE (CVE-2025-24893 – XWiki SSTI unauthenticated RCE exploit (HackTheBox CTF)) (April 17, 2026)
- Exploit #12089 - CVE-2025-24893-PoC (XWiki Unauthenticated RCE Exploit for Reverse Shell) (November 7, 2025)
- Exploit #12087 - CVE-2025-24893 (November 7, 2025)
- Exploit #12020 - CVE-2025-24893 (October 8, 2025)
- Exploit #11990 - Exploits (A collection of CVE exploits I wrote) (September 26, 2025)
- Exploit #11956 - xwiki-15.10.8-reverse-shell-cve-2025-24893 (CVE-2025-24893 RCE exploit for XWiki with reverse shell capability) (September 12, 2025)
- Exploit #11935 - CVE-2025-24893 (September 5, 2025)
- Exploit #11920 - Remote Code Execution Vulnerability in XWiki Platform (CVE-2025-24893) (September 1, 2025)
- Exploit #11919 - POC-for-CVE-2025-24893 (Some poorly crafted exploit scripts) (August 30, 2025)
- Exploit #11918 - CVE-2025-24893 (August 30, 2025)
- Exploit #11914 - solrsearch-rce-exploit (Unauth RCE PoC for XWiki SolrSearch (CVE-2025-24893). Command exec + reverse shell. Built during process of pwning HTB “Editor”) (August 30, 2025)
- Exploit #11913 - xwiki_solrsearch-rce-exploit (Unauth RCE PoC for XWiki SolrSearch (CVE-2025-24893). Command exec + reverse shell.) (August 30, 2025)
- Exploit #11871 - cve-2025-24893 (August 22, 2025)
- Exploit #11861 - CVE-2025-24893 (PoC exploit for XWiki Remote Code Execution Vulnerability (CVE-2025-24893)) (August 22, 2025)
- Exploit #11845 - cve-2025-24893-poc ( Proof-of-Concept exploit for CVE-2025-24893, an unauthenticated Remote Code Execution (RCE) vulnerability in XWiki. Exploits a template injection flaw in the SolrSearch endpoint via Groovy script execution.) (August 8, 2025)
- Exploit #11839 - CVE-2025-24893-XWiki-Unauthenticated-RCE-Exploit-POC (August 8, 2025)
- Exploit #11833 - CVE-2025-24893 (August 8, 2025)
- Exploit #11481 - cve-2025-24893 (June 6, 2025)
- Exploit #11378 - CVE-2025-24893-EXP (May 9, 2025)
- Exploit #11179 - CVE-2025-24893-PoC (February 25, 2025)
External References
- https://github.com/xwiki/xwiki-platform/blob/568447cad5172d97d6bbcfda9f6183689c2cf086/xwiki-platform-core/xwiki-platform-search/xwiki-platform-search-solr/xwiki-platform-search-solr-ui/src/main/resources/Main/SolrSearchMacros.xml#L955
- https://github.com/xwiki/xwiki-platform/blob/67021db9b8ed26c2236a653269302a86bf01ef40/xwiki-platform-core/xwiki-platform-web/xwiki-platform-web-templates/src/main/resources/templates/macros.vm#L2824
- https://github.com/xwiki/xwiki-platform/commit/67021db9b8ed26c2236a653269302a86bf01ef40
- https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-rr6p-3pfg-562j
- https://jira.xwiki.org/browse/XWIKI-22149