XWiki Platform SolrSearch Remote Code Execution (RCE) Vulnerability Advisory (CVE-2025-24893)
Executive & SecOps Summary
SECOPS ASSESSMENTXWiki Platform versions prior to 15.10.11, 16.4.1, and 16.5.0RC1
Unauthenticated remote attackers can execute arbitrary Groovy code via the SolrSearch API, leading to complete compromise of the host system.
Immediately upgrade to patched versions (15.10.11, 16.4.1, 16.5.0RC1 or later) or apply the recommended XML macro workaround.
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
The recommended remediation is to upgrade XWiki to a patched release.
# For Debian/Ubuntu-based systems using APT package manager
sudo apt-get update
sudo apt-get --only-upgrade install xwiki-tomcat9-common -y
# For Docker-based deployments, update the image tag in docker-compose.yml
# Example: xwiki:16.4.1-postgres-tomcat
docker pull xwiki:16.4.1-postgres-tomcat
docker-compose up -d2. Temporary Workaround & Hardening Configuration
If an immediate upgrade is not feasible, modify Main.SolrSearchMacros in SolrSearchMacros.xml around line 955 to use the secure rawResponse macro.
# Locate and edit SolrSearchMacros.xml in your XWiki installation directory
# Replace the direct content output with the rawResponse macro with application/xml content type
# [Before Modification]
# $response.setContentLength($content.length())
# $response.write($content)
# [After Modification (referencing macros.vm#L2824)]
# #set($discard = $response.setContentType('application/xml'))
# $services.rendering.render($doc.getDocumentReference(), 'xhtml')3. Log Audit & IoC Verification Commands
Use the following commands to scan web server access logs for exploitation attempts and verify vulnerability status.
# Scan Nginx/Apache access logs for SolrSearch RCE payloads
grep -Ei 'SolrSearch.*media=rss.*(groovy|async|velocity)' /var/log/nginx/access.log /var/log/apache2/access.log 2>/dev/null
# Active verification script (for authorized testing only)
curl -s -G 'http://localhost:8080/xwiki/bin/get/Main/SolrSearch' \
--data-urlencode 'media=rss' \
--data-urlencode 'text=}}}{{async async=false}}{{groovy}}println("Vulnerable_Check:" + (20+22)){{/groovy}}{{/async}}' \
| grep -q 'Vulnerable_Check:42' && echo '[ALERT] Instance is VULNERABLE to CVE-2025-24893!' || echo '[INFO] Instance is secure/patched.'Block Exploits Instantly with Managed Virtual Patching Rules
Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability is a critical remote code execution (RCE) flaw in the SolrSearch component of the XWiki Platform. XWiki provides a built-in search interface powered by Solr, which supports rendering search results in RSS feed format via the media=rss parameter. The root cause lies in the Main.SolrSearchMacros template, which fails to properly sanitize or escape user-supplied input in the text parameter before passing it to the rendering engine, leading to template injection.
2. Exploitation Mechanics & Attack Scenario
An unauthenticated attacker (with Guest privileges) can send a crafted HTTP GET request to the Main/SolrSearch endpoint. By injecting the XWiki rendering syntax closer }}, the attacker escapes the current rendering context and injects an asynchronous execution block ({{async}}) containing an arbitrary script block ({{groovy}}). The rendering engine processes this injected block with high privileges, executing the arbitrary Groovy code and embedding the output directly into the RSS feed response.
3. Infrastructure & Business Impact
With a CVSS score of 9.8 and its inclusion in the CISA KEV catalog, this vulnerability poses an immediate and severe threat to enterprise infrastructure. Successful exploitation allows full remote code execution without authentication, enabling attackers to exfiltrate sensitive database credentials, deface wiki content, deploy ransomware, or establish a persistent foothold within the internal network.
Official Vendor Advisories & References
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any guest can perform arbitrary remote code execution through a request to `SolrSearch`. This impacts the confidentiality, integrity and availability of the whole XWiki installation. To reproduce on an instance, without being logged in, go to `<host>/xwiki/bin/get/Main/SolrSearch?media=rss&text=%7D%7D%7D%7B%7Basync%20async%3Dfalse%7D%7D%7B%7Bgroovy%7D%7Dprintln%28"Hello%20from"%20%2B%20"%20search%20text%3A"%20%2B%20%2823%20%2B%2019%29%29%7B%7B%2Fgroovy%7D%7D%7B%7B%2Fasync%7D%7D%20`. If there is an output, and the title of the RSS feed contains `Hello from search text:42`, then the instance is vulnerable. This vulnerability has been patched in XWiki 15.10.11, 16.4.1 and 16.5.0RC1. Users are advised to upgrade. Users unable to upgrade may edit `Main.SolrSearchMacros` in `SolrSearchMacros.xml` on line 955 to match the `rawResponse` macro in `macros.vm#L2824` with a content type of `application/xml`, instead of simply outputting the content of the feed.
Frequently Asked SecOps Questions (CVE-2025-24893)
FAQQ1. How critical is CVE-2025-24893 and is it actively exploited in the wild?
CVE-2025-24893 is rated CVSS 9.8 (CRITICAL) with a 30-day EPSS exploitation probability of 100.0%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2025-24893?
Primary impacted vendors include xwiki across xwiki-platform. Scope summary: XWiki Platform versions < 15.10.11, < 16.4.1, and < 16.5.0RC1
Q3. What temporary mitigations or workarounds exist for CVE-2025-24893 before patching?
[Mitigation] Immediately upgrade to patched versions (15.10.11, 16.4.1, 16.5.0RC1 or later) or apply the recommended XML macro workaround. Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2025-24893
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (xwiki)
View Category →Langflow Unauthenticated Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-33017)
[Affected Scope] Langflow versions prior to 1.9.0
IBM Langflow OSS Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-9198)
[Affected Scope] IBM Langflow OSS versions 1.0.0 through 1.10.0 in default deployments
Microsoft SharePoint Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-65660)
[Affected Scope] Microsoft SharePoint Server 2016, 2019, and Subscription Edition.
Apache ActiveMQ Jolokia JMX-HTTP Bridge Remote Code Execution Vulnerability Advisory (CVE-2026-34197)
[Affected Scope] Apache ActiveMQ Classic versions prior to 5.19.4, and 6.0.0 through 6.2.3
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.