CVE-2025-24893— Remote code execution as guest via SolrSearchMacros request in xwiki
Quick assessment
Affected
xwiki xwiki-platform
Exploitation
Confirmed exploitation in the wild; remediate immediately
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
XWiki Platform是XWiki开源的一套用于创建Web协作应用程序的Wiki平台。 XWiki Platform存在安全漏洞，该漏洞源于任何来宾用户都可以通过对SolrSearch的请求，造成远程代码执行。
Public Exploits 4
Metasploit · 1
xwiki_unauth_rce_cve_2025_24893.rb [exploit]
Nuclei · 1
CVE-2025-24893.yaml [template]
In-the-Wild Activity Observed
github_trending · low
cisa_kev · confirmed
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2025-24893
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Remote code execution as guest via SolrSearchMacros request in xwiki
Source: CVE Program / CVE List V5
Vulnerability Description
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any guest can perform arbitrary remote code execution through a request to `SolrSearch`. This impacts the confidentiality, integrity and availability of the whole XWiki installation. To reproduce on an instance, without being logged in, go to `<host>/xwiki/bin/get/Main/SolrSearch?media=rss&text=%7D%7D%7D%7B%7Basync%20async%3Dfalse%7D%7D%7B%7Bgroovy%7D%7Dprintln%28"Hello%20from"%20%2B%20"%20search%20text%3A"%20%2B%20%2823%20%2B%2019%29%29%7B%7B%2Fgroovy%7D%7D%7B%7B%2Fasync%7D%7D%20`. If there is an output, and the title of the RSS feed contains `Hello from search text:42`, then the instance is vulnerable. This vulnerability has been patched in XWiki 15.10.11, 16.4.1 and 16.5.0RC1. Users are advised to upgrade. Users unable to upgrade may edit `Main.SolrSearchMacros` in `SolrSearchMacros.xml` on line 955 to match the `rawResponse` macro in `macros.vm#L2824` with a content type of `application/xml`, instead of simply outputting the content of the feed.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
动态执行代码中指令转义处理不恰当(Eval注入)
Source: CVE Program / CVE List V5
Vulnerability Title
XWiki Platform 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
XWiki Platform是XWiki开源的一套用于创建Web协作应用程序的Wiki平台。 XWiki Platform存在安全漏洞，该漏洞源于任何来宾用户都可以通过对SolrSearch的请求，造成远程代码执行。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Shenlong Deep Dive — AI Deep Analysis
10-question deep dive: root cause, exploitation, mitigation, urgency. Read summary free, full version requires login.
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| xwiki | xwiki-platform | >= 5.3-milestone-2, < 15.10.11 | - |
|
II. Public POCs for CVE-2025-24893
| # | POC Description | Source Link | Shenlong Link |
|---|---|---|---|
| 1 | XWiki Remote Code Execution (CVE-2025-24893) PoC | https://github.com/sug4r-wr41th/CVE-2025-24893 | POC Details |
| 2 | XWiki SolrSearchMacros 远程代码执行漏洞PoC（CVE-2025-24893） | https://github.com/iSee857/CVE-2025-24893-PoC | POC Details |
| 3 | Any guest can perform arbitrary remote code execution through a request to SolrSearch. This impacts the confidentiality, integrity, and availability of the whole XWiki installation. This vulnerability has been patched in XWiki 15.10.11, 16.4.1, and 16.5.0RC1. | https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-24893.yaml | POC Details |
| 4 | None | https://github.com/Artemir7/CVE-2025-24893-EXP | POC Details |
| 5 | None | https://github.com/nopgadget/CVE-2025-24893 | POC Details |
| 6 | This is a small script for the rce vulnerability for CVE-2025-24893. It supports basic input/output | https://github.com/Kai7788/CVE-2025-24893-RCE-PoC | POC Details |
| 7 | this is a poc for the CVE-2025-24893 | https://github.com/AliElKhatteb/CVE-2024-32019-POC | POC Details |
| 8 | None | https://github.com/dhiaZnaidi/CVE-2025-24893-PoC | POC Details |
| 9 | Modified exploit for CVE-2025-24893 | https://github.com/hackersonsteroids/cve-2025-24893 | POC Details |
| 10 | PoC exploits CVE-2025-24893 , a remote code execution (RCE) vulnerability in XWiki caused by improper sandboxing in Groovy macros rendered asynchronously. It allows arbitrary command execution through injection into RSS-based SolrSearch endpoints. | https://github.com/Infinit3i/CVE-2025-24893 | POC Details |
| 11 | PoC for CVE-2025-24893: XWiki' Remote Code Execution exploit for versions prior to 15.10.11, 16.4.1 and 16.5.0RC1. | https://github.com/gunzf0x/CVE-2025-24893 | POC Details |
| 12 | CVE-2025-24893 is a critical unauthenticated remote code execution vulnerability in XWiki (versions < 15.10.11, 16.4.1, 16.5.0RC1) caused by improper handling of Groovy expressions in the SolrSearch macro. | https://github.com/dollarboysushil/CVE-2025-24893-XWiki-Unauthenticated-RCE-Exploit-POC | POC Details |
| 13 | PoC | XWiki Platform 15.10.10 - Remote Code Execution | https://github.com/zs1n/CVE-2025-24893 | POC Details |
| 14 | Proof-of-Concept exploit for CVE-2025-24893, an unauthenticated Remote Code Execution (RCE) vulnerability in XWiki. Exploits a template injection flaw in the SolrSearch endpoint via Groovy script execution. | https://github.com/investigato/cve-2025-24893-poc | POC Details |
| 15 | PoC for CVE-2025-24893 | https://github.com/570RMBR3AK3R/xwiki-cve-2025-24893-poc | POC Details |
| 16 | CVE-2025-24893 is a critical unauthenticated remote code execution (RCE) vulnerability in XWiki, a popular open-source enterprise wiki platform. | https://github.com/IIIeJlyXaKapToIIIKu/CVE-2025-24893-XWiki-unauthenticated-RCE-via-SolrSearch | POC Details |
| 17 | Bash POC script for RCE vulnerability in XWiki Platform | https://github.com/mah4nzfr/CVE-2025-24893 | POC Details |
| 18 | None | https://github.com/Th3Gl0w/CVE-2025-24893-POC | POC Details |
| 19 | This vulnerability could allow a malicious user to execute remote code by sending appropriately crafted requests to the default search engine SolrSearch | https://github.com/Hex00-0x4/CVE-2025-24893-XWiki-RCE | POC Details |
| 20 | POC | https://github.com/The-Red-Serpent/CVE-2025-24893 | POC Details |
| 21 | XWiki 15.10.11, 16.4.1 and 16.5.0RC1 Unauthenticated Remote code execution POC | https://github.com/alaxar/CVE-2025-24893 | POC Details |
| 22 | POC exploit for CVE-2025-24893 | https://github.com/D3Ext/CVE-2025-24893 | POC Details |
| 23 | A POC for CVE-2025-24893 written in python | https://github.com/Retro023/CVE-2025-24893-POC | POC Details |
| 24 | PoC exploit for XWiki Remote Code Execution Vulnerability (CVE-2025-24893) | https://github.com/CMassa/CVE-2025-24893 | POC Details |
| 25 | Some poorly crafted exploit scripts | https://github.com/x0da6h/POC-for-CVE-2025-24893 | POC Details |
| 26 | A critical remote code execution (RCE) vulnerability (CVE‑2025‑24893) exists in the XWiki Platform, specifically in the SolrSearch RSS feed endpoint. | https://github.com/ibadovulfat/CVE-2025-24893_HackTheBox-Editor-Writeup | POC Details |
| 27 | Unauth RCE PoC for XWiki SolrSearch (CVE-2025-24893). Command exec + reverse shell. Built during process of pwning HTB “Editor” | https://github.com/torjan0/xwiki_solrsearch-rce-exploit | POC Details |
| 28 | Reverse Shell Payload for CVE-2025-24893 | https://github.com/AzureADTrent/CVE-2025-24893-Reverse-Shell | POC Details |
| 29 | None | https://github.com/b0ySie7e/CVE-2025-24893 | POC Details |
| 30 | None | https://github.com/andwati/CVE-2025-24893 | POC Details |
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-24893
请登录查看更多情报信息。
Patches & Fixes for CVE-2025-24893 (4)
Vendor Advisories for CVE-2025-24893 (1)
IV. Related Vulnerabilities
Same product: xwiki-platform
-
CVE-2026-48048
XWiki Platform's Livetable results still allow reconstructin -
CVE-2026-48047
XWiki Platform vulnerable to potential arbitrary file writin -
CVE-2026-33137
XWiki Platform has an Unauthenticated XAR Import via REST /w -
CVE-2026-40105
XWiki has Reflected Cross-Site Scripting (XSS) in its page h -
CVE-2026-33229
XWiki Platform affected by remote code execution with script
Same vendor: xwiki
-
CVE-2026-48048
XWiki Platform's Livetable results still allow reconstructin -
CVE-2026-48047
XWiki Platform vulnerable to potential arbitrary file writin -
CVE-2026-33137
XWiki Platform has an Unauthenticated XAR Import via REST /w -
CVE-2026-23734
XWiki Platform: Path traversal via resources parameter in ss -
CVE-2026-40105
XWiki has Reflected Cross-Site Scripting (XSS) in its page h
Same weakness: CWE-95
-
CVE-2026-78136
CHIRP代码注入漏洞（eval注入） -
CVE-2026-61539
Xinference: Remote code execution via unsafe `eval()` in Lla -
CVE-2026-77810
Code Injection via Gremlin Query Passthrough in Amazon Athen -
CVE-2026-76833
@cgauge/yaml npm Package Arbitrary Code Execution via eval() -
CVE-2026-34398
FreeCAD: Arbitrary Code Execution via eval() on untrusted pr
V. Comments for CVE-2025-24893
Anonymous User
2026-01-15 06:08:49Zaproxy alias impedit expedita quisquam pariatur exercitationem. Nemo rerum eveniet dolores rem quia dignissimos.