This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.

[TLP:CLEAR] XWiki fixes a critical vulnerability

XWiki fixes a critical vulnerability in versions 15.10.11, 16.4.1 and 16.5.0-rc-1 [1].

XWiki - RCE (CVE-2025-24893)
CVSS 9.8 (Critical)

Due to insufficient validation of search input, an unauthenticated remote attacker can run Groovy or Velocity code, which allows arbitrary actions to be performed in the operating system of the instance with the privileges of the user under which the XWiki instance is running [2]. A PoC script can be obtained from [3], where the password for the file is "ZDI-CAN-23994" and a description of its functionality can be found at [2]. Information about a temporary fix can be found at [1].

The vulnerability is present in product:

  • Xwiki; >= 5.3-milestone-2, < 15.10.11; >= 16.0.0-rc-1, < 16.4.1;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

More information:

  • CVE-2025-24893 at cve.org, NVD
  • CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') at cwe.mitre.org

The vulnerability was publicly disclosed 20. 2. 2025.

By CESNET, z.s.p.o. Martin Krajči on 26. 2. 2025.

CESNET, z.s.p.o. Logo