PoC for CVE-2025-24893 — XWiki Remote Code Execution (Safe PoC)
PoC for CVE-2025-24893: XWiki' Remote Code Execution exploit for versions prior to 15.10.11, 16.4.1 and 16.5.0RC1.
⚠️ IMPORTANT — AUTHORIZED TESTING ONLY
This repository contains a proof-of-concept (PoC) project intended for educational and authorized vulnerability testing. Do not use any exploit code or techniques against systems you do not own or do not have explicit written permission to test. Unauthorized use may be illegal.
Overview
- CVE: CVE-2025-24893
- Product: XWiki Platform
- Affected versions (reported): versions prior to 15.10.11, 16.4.1, and 16.5.0RC1.
- Impact: Remote Code Execution (RCE) via code (Groovy) injection when certain endpoints render untrusted content.
- PoC intent: Demonstrate that arbitrary code execution is possible in a controlled environment — this README and associated scripts are sanitized for safe, responsible use.
What this repository provides (safe mode)
- A non-destructive PoC script that demonstrates how an RCE condition might be triggered, without containing working exploit payloads (no reverse shells, no malicious one-liners).
- A robust test harness for sending benign commands (e.g.
uname -a, echo "POC OK") to a target XWiki instance you control.
Requirements
- Python 3.8+
requests Python package:
the-red-serpent/cve-2025-24893
