CVE-2025-24893: (severity: 9.8/10)

XWiki Remote code execution as guest via SolrSearchMacros request.
Any guest can perform arbitrary remote code execution through a request to SolrSearch. This impacts the confidentiality, integrity and availability of the whole XWiki installation.

This vulnerability has been patched in XWiki 15.10.11, 16.4.1 and 16.5.0RC1.

- PoC (python)
- GitHub Advisory Database
- Template Source
- Macros.vm source
- patch commit

Weakness Enumeration:
- CWE-94: Improper Control of Generation of Code ('Code Injection')
- CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')

#cve #vulnerability #java