Remote code execution as guest via SolrSearchMacros request in xwiki (CVE-2025-24893)

What is affected, what to do

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any guest can perform arbitrary remote code execution through a request to `SolrSearch`.

The vulnerability is being actively exploited; treat it as a priority. Update xwiki to version 15.10.11. Immediate actions, mitigation and detection rules are in the runbook below.

Affected

• CryptPad Xwiki-platform gte 5.3-milestone-2, < 15.10.11..*

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Response and mitigation

1. 01

   Runbook step 1

   Immediate response (0-24 h)

   • Upgrade XWiki to a patched release without delay: 15.10.11 (LTS), 16.4.1 (stable) or 16.5.0RC1. Take a database snapshot and permanent directory backup first — if the instance was already compromised, persistence may live inside XWiki documents.
   • If patching is not immediately feasible, apply the vendor workaround: edit Main.SolrSearchMacros in SolrSearchMacros.xml at line 955 so it uses the rawResponse macro from macros.vm#L2824 with content type application/xml, instead of rendering the feed content directly.
   • Verify exploitability by requesting /xwiki/bin/get/Main/SolrSearch?media=rss&text=}}}{{async async=false}}{{groovy}}println("Hello from" + " search text:" + (23 + 19)){{/groovy}}{{/async}} — if the RSS title contains "Hello from search text:42", the instance is vulnerable.
   • Put internet-exposed XWiki instances behind authentication (reverse proxy with basic auth or forced SSO) or disconnect them from the internet until patched. Guest access is the primary attack vector.
   • Compromise assessment: grep access logs of the last 60 days for SolrSearch requests containing {{groovy}}, {{async, {{python}}, {{velocity}} or URL-encoded variants (%7B%7Bgroovy%7D%7D). Any hit triggers full IR, because RCE ran as the xwiki service user.
   • Rotate every secret the XWiki process knew: DB credentials in hibernate.cfg.xml, LDAP bind accounts, SMTP, API keys stored in configuration objects — unless exploitation can be ruled out.
2. 02

   Runbook step 2

   Mitigation layers

   • Network segmentation: deny outbound internet from the XWiki host via egress firewall to break second-stage payload delivery and reverse shells. Allow only DB, LDAP and SMTP as explicit destinations.
   • WAF/reverse-proxy rule: block or quarantine requests to /xwiki/bin/*/Main/SolrSearch when the text parameter contains the tokens {{groovy}}, {{async, {{python}}, {{velocity}}, }}}, {{/ or their URL-encoded equivalents. Add a generic rule flagging {{ in query strings for unauthenticated sessions.
   • Hardening: disable Groovy, Python and Velocity scripting in xwiki.cfg, or restrict them to users with programming rights (xwiki.rendering.transformations.execution.*), where functionally acceptable. Revoke guest permissions to render these macros.
   • OS least privilege: run XWiki as an unprivileged user (xwiki:xwiki) with NoNewPrivileges=yes, ProtectSystem=strict, ProtectHome=yes in the systemd unit. Write access only to permanent directory and logs.
   • IPS/Suricata: signature on HTTP URI pattern SolrSearch combined with groovy or %7Bgroovy%7D in the query string; alert on exfiltration patterns such as long base64 blobs in XWiki POST bodies.
   • Review backup strategy: keep offline backups of the XWiki database and permanent directory so that, if compromise is discovered later, a clean restore point from before the first exploit attempt exists.
3. 03

   Runbook step 3

   Detection rules

   • Web access log (Apache/Nginx/Tomcat): regex GET.*/xwiki/bin/(get|view)/Main/SolrSearch.*(groovy|async|velocity|python|%7B%7B) — any match from an unauthenticated session is an exploitation attempt, not scanner noise.
   • Sigma shape (process_creation, Linux): ParentImage ending in java with command line containing xwiki, ChildImage is sh, bash, curl, wget, python, perl, nc or /tmp/*. Direct child processes of the XWiki JVM are near-nonexistent under normal operations.
   • EDR/Sysmon (Windows Tomcat deployments): EID 1 with ParentImage=*java.exe and Image in (cmd.exe, powershell.exe, certutil.exe, bitsadmin.exe); additionally EID 3 for outbound connections from the Java process to non-whitelisted IPs.
   • KQL snippet (Sentinel/Defender): W3CIISLog | where csUriStem contains "SolrSearch" and csUriQuery has_any ("groovy","%7Bgroovy","{{async","velocity") | summarize count() by cIP, bin(TimeGenerated, 1h).
   • Zeek/Suricata: monitor XWiki HTTP traffic for URI length > 500 bytes on the /Main/SolrSearch endpoint — typical exploit payloads are far longer than legitimate search queries.
   • XWiki application log: review entries containing GroovyException, ScriptExecutionException, or newly created documents containing script macros in AttachmentHistory.

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any guest can perform arbitrary remote code execution through a request to `SolrSearch`. This impacts the confidentiality, integrity and availability of the whole XWiki installation. To reproduce on an instance, without being logged in, go to `<host>/xwiki/bin/get/Main/SolrSearch?media=rss&text=%7D%7D%7D%7B%7Basync%20async%3Dfalse%7D%7D%7B%7Bgroovy%7D%7Dprintln%28"Hello%20from"%20%2B%20"%20search%20text%3A"%20%2B%20%2823%20%2B%2019%29%29%7B%7B%2Fgroovy%7D%7D%7B%7B%2Fasync%7D%7D%20`. If there is an output, and the title of the RSS feed contains `Hello from search text:42`, then the instance is vulnerable. This vulnerability has been patched in XWiki 15.10.11, 16.4.1 and 16.5.0RC1. Users are advised to upgrade. Users unable to upgrade may edit `Main.SolrSearchMacros` in `SolrSearchMacros.xml` on line 955 to match the `rawResponse` macro in `macros.vm#L2824` with a content type of `application/xml`, instead of simply outputting the content of the feed.

Source: pwn.watch, NVD (NIST), OSV (Open Source Vulnerabilities), cvelistv5, CISA KEV Catalog, CVE.org (MITRE)

Vendors and products

• CryptPad XWiki Platform
• CryptPad Xwiki-platform

Weakness classes (CWE)

• CWE-95Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')

  Variant

  The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. "eval").

  Entry at MITRE CWE-95

References & sources

• github.comxwiki/xwiki-platform/security/advisories/GHSA-rr6p-3pfg-562jweb, x_refsource_CONFIRM, Vendor advisory, pwn-watch
• NVD (NIST)NVD: CVE-2025-24893advisory, pwn-watch
• github.comxwiki/xwiki-platform/commit/67021db9b8ed26c2236a653269302a86bf0…web, x_refsource_MISC, Patch
• github.comxwiki/xwiki-platformpackage
• github.comxwiki/xwiki-platform/blob/568447cad5172d97d6bbcfda9f6183689c2cf…web, x_refsource_MISC, Product
• github.comxwiki/xwiki-platform/blob/67021db9b8ed26c2236a653269302a86bf01e…web, x_refsource_MISC, Product
• jira.xwiki.orgbrowse/XWIKI-22149web, x_refsource_MISC, Exploit, Issue tracking, Vendor advisory
• cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2025-24893web, government-resource, US government resource
• pwn.watchpwn.watch: XWiki Platform: Platform Eval Injection Vulnerabilitypwn-watch
• cisa.govCISA Known Exploited Vulnerabilities Catalogpwn-watch