Historical catalog analysis: CISA added this entry on October 30, 2025. The entry reflects catalog information retrieved on August 31, 2026, not a snapshot archived on the inclusion date. Check current vendor guidance before acting.
What the vulnerability is
CVE-2025-24893 is an eval injection vulnerability (CWE-95) identified in the XWiki Platform. The flaw allows an unauthenticated guest user to execute arbitrary code on the host system by sending a specially crafted request to the SolrSearch component.
Exposure and applicability
This vulnerability affects organizations deploying the XWiki Platform where the SolrSearch functionality is accessible to guests. Because the entry point does not require authentication, any entity with network access to the XWiki instance’s search interface may be in a position to trigger the injection. Infrastructure owners should identify all instances of the platform and determine if guest access to SolrSearch is enabled.
Remediation priorities
Based on our analysis, vulnerability management teams should prioritize the following actions:
- Apply Vendor Mitigations: The primary corrective action is to implement the mitigations provided by XWiki. This should be the immediate priority for all exposed instances.
- Cloud Service Review: For organizations utilizing XWiki via cloud providers, we recommend reviewing configurations against BOD 22-01 guidance to ensure the service provider has addressed the exposure.
- Service Decommissioning: In scenarios where vendor mitigations cannot be applied or are unavailable for a specific legacy deployment, the product should be discontinued to eliminate the attack surface.
How to validate remediation
Verification must go beyond confirming a version number or the presence of a patch. To assure that exposure has been reduced, defenders should:
- Verify Component State: Confirm that the SolrSearch component is either updated to a mitigated version or that guest access to this specific function has been disabled.
- Functional Testing: Use authorized security testing tools to attempt a request to the SolrSearch endpoint to verify that the eval injection path is no longer viable.
Confirmation of a successful mitigation is achieved when the system no longer processes the malicious input as executable code, rather than simply observing a version string in a dashboard.
Limits and open questions
While the vulnerability allows for remote code execution, it remains unknown whether this flaw has been utilized by ransomware campaigns. Additionally, while CISA has established a remediation deadline of November 20, 2025, for federal agencies, non-federal organizations must determine their own risk appetite and patching cadence. Residual risk may remain if compensating controls are used instead of a direct patch, as these may not address all possible injection vectors within the SolrSearch component.
Source and editorial note
CVE-2025-24893: XWiki Platform Eval Injection Vulnerability · Source date: October 30, 2025 · Retrieved August 31, 2026.
Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.
Archive date: November 02, 2025. The displayed post date is assigned three days after the source date to organize this retrospective archive; it does not mean this site published the analysis then. First published by this site: September 29, 2026 at 00:46 UTC.
Request a Vulnerability Assessment
Turn security intelligence into action.
Discuss your exposure, priorities, and the evidence needed to validate the outcome.
Request a security assessment ↗