CVE-2025-24893: XWiki SolrSearch unauthenticated remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityUnauthenticated network-reachable remote code execution with a CVSS score of 9.8, active exploitation indicated by CISA KEV and near-maximum EPSS probability.

What it is

XWiki Platform's SolrSearch endpoint evaluates user-supplied search text as Groovy code, allowing arbitrary remote code execution. The flaw is reachable by any unauthenticated guest, and successful exploitation compromises the confidentiality, integrity and availability of the entire XWiki installation.

Impact

An attacker gains remote code execution with the privileges of the XWiki server process, enabling full read and write access to wiki data and the underlying host. This can lead to data theft, defacement, or complete takeover of the installation.

Attack surface

Reached over the network via an HTTP request to the SolrSearch endpoint with a crafted text parameter; no authentication or user interaction is required per the CVSS vector (AV:N/AC:L/PR:N/UI:N).

Exploitation

The vulnerability is listed in CISA KEV with a due date of 2025-11-20, and EPSS shows a 30-day probability of 0.99864 (99.9th percentile), indicating active exploitation is expected or observed. A public exploit reference is tagged in the vendor Jira issue.

What to do

• Upgrade to XWiki 15.10.11, 16.4.1, or 16.5.0RC1 or later.
• If immediate upgrade is not possible, edit Main.SolrSearchMacros in SolrSearchMacros.xml at line 955 to match the rawResponse macro in macros.vm#L2824 with content type application/xml instead of outputting feed content directly.
• Restrict network access to the XWiki SolrSearch endpoint where feasible.
• Monitor for and block requests containing Groovy or async macro syntax in the text parameter.
• Follow CISA BOD 22-01 guidance for cloud services or discontinue use if mitigations cannot be applied.

Detection

• Search web server and XWiki logs for requests to /xwiki/bin/get/Main/SolrSearch with suspicious text parameters containing {{groovy}}, {{async}}, or similar macro syntax.
• Monitor for RSS feed responses containing unexpected output such as 'Hello from search text:42' or other injected content.
• Alert on outbound network connections or process execution spawned by the XWiki Java process that are not part of normal operation.
• Review XWiki audit logs for unexpected page edits, configuration changes, or new administrative users.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.