CVE-2025-24893: XWiki Platform Eval Injection Vulnerability
Impact Any guest can perform arbitrary remote code execution through a request to SolrSearch. This impacts the confidentiality, integrity and availability of the whole XWiki installation.
To reproduce on an instance, without being logged in, go to <host>/xwiki/bin/get/Main/SolrSearch?media=rss&text=%7D%7D%7D%7B%7Basync%20async%3Dfalse%7D%7D%7B%7Bgroovy%7D%7Dprintln%28"Hello%20from"%20%2B%20"%20search%20text%3A"%20%2B%20%2823%20%2B%2019%29%29%7B%7B%2Fgroovy%7D%7D%7B%7B%2Fasync%7D%7D%20. If there is an output, and the title of the RSS feed contains Hello from search text:42, then the instance is vulnerable.
Patches This vulnerability has been patched in XWiki 15.10.11, 16.4.1 and 16.5.0RC1.
Workarounds This line in Main.SolrSearchMacros can be edited to match the rawResponse macro defined here with a content type of application/xml, instead of simply outputting the content of the feed.
References
https://jira.xwiki.org/browse/XWIKI-22149 https://github.com/xwiki/xwiki-platform/commit/67021db9b8ed26c2236a653269302a86bf01ef40
Attribution This vulnerability has been reported by John Kwak for Trend Micro's Zero Day Initiative.
Other sources
XWiki Platform contains an eval injection vulnerability that could allow any guest to perform arbitrary remote code execution through a request to SolrSearch.
— CISA
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any guest can perform arbitrary remote code execution through a request to SolrSearch. This impacts the confidentiality, integrity and availability of the whole XWiki installation. To reproduce on an instance, without being logged in, go to <host>/xwiki/bin/get/Main/SolrSearch?media=rss&text=%7D%7D%7D%7B%7Basync%20async%3Dfalse%7D%7D%7B%7Bgroovy%7D%7Dprintln%28"Hello%20from"%20%2B%20"%20search%20text%3A"%20%2B%20%2823%20%2B%2019%29%29%7B%7B%2Fgroovy%7D%7D%7B%7B%2Fasync%7D%7D%20. If there is an output, and the title of the RSS feed contains Hello from search text:42, then the instance is vulnerable. This vulnerability has been patched in XWiki 15.10.11, 16.4.1 and 16.5.0RC1. Users are advised to upgrade. Users unable to upgrade may edit Main.SolrSearchMacros in SolrSearchMacros.xml on line 955 to match the rawResponse macro in macros.vm#L2824 with a content type of application/xml, instead of simply outputting the content of the feed.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.xwiki.platform:xwiki-platform-search-solr-uito a version that resolves this vulnerability.Fixed in 16.4.1 - Upgrade
Upgrade
maven/org.xwiki.platform:xwiki-platform-search-solr-uito a version that resolves this vulnerability.Fixed in 15.10.11 - Upgrade
Upgrade
maven/org.xwiki.platform:xwiki-platform-search-solr-uito a version that resolves this vulnerability.Fixed in 16.5.0RC1 - Configuration
Edit Main.SolrSearchMacros (around line 955 in SolrSearchMacros.xml) to match the rawResponse macro definition and output with content type application/xml instead of directly outputting the feed content.
Main.SolrSearchMacros (SolrSearchMacros.xml) SolrSearch macro output handling = use rawResponse macro with content type application/xml - Compensating control
Apply vendor-provided mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-24893?
CVE-2025-24893 is a high-severity vulnerability that allows arbitrary remote code execution.
How do I fix CVE-2025-24893?
To fix CVE-2025-24893, you should upgrade your XWiki Platform to a version higher than 16.5.0RC1.
What products are affected by CVE-2025-24893?
CVE-2025-24893 affects XWiki Platform versions up to 15.10.11, 16.4.1, and 16.5.0RC1.
Who can exploit CVE-2025-24893?
Any guest user can exploit CVE-2025-24893 to perform remote code execution through a request to SolrSearch.
What impact does CVE-2025-24893 have?
CVE-2025-24893 impacts the confidentiality, integrity, and availability of the entire XWiki installation.