CVE-2025-24893 XWiki RCE Vulnerability Analysis

Environment Setup

1. Running XWiki 15.10.10 Environment

docker-compose up -d

2. Accessing XWiki

• URL: http://localhost:8080
• Proceed with testing after completing the initial setup
• Create an admin account after accessing the initial page
• Install XWiki default extensions
• Grant user script rights

Vulnerability Information

• CVE ID: CVE-2025-24893
• Product: XWiki Platform
• Version: 15.10.10
• Vulnerability Type: Remote Code Execution (RCE)
• CVSS: TBD

PoC Code

The PoC performs RCE via template injection in the SolrSearch functionality.

Analysis Environment