CVE-2025-24893

An attacker sends an HTTP GET request to the path `/xwiki/bin/get/Main/SolrSearch` with a `text` parameter containing a malicious payload in XWiki template format (e.g., a `{{groovy}}` block). The `SolrSearch` endpoint in vulnerable versions does not properly sanitize input data before processing, which enables Groovy code injection and evaluation (CWE-94, CWE-95) on the server side. The attack requires no authentication or user interaction — a single network request is sufficient.

An attacker gains the ability to execute arbitrary code on the server (RCE), which threatens the confidentiality, integrity, and availability of the entire XWiki installation, including access to all user data and server infrastructure.

XWiki should be updated to version 15.10.11, 16.4.1, or 16.5.0RC1. Users who cannot perform an update should manually edit the `Main.SolrSearchMacros` file (`SolrSearchMacros.xml`, line 955) — the `rawResponse` macro should be adjusted to set the content type to `application/xml` instead of directly outputting the RSS feed content, following the pattern from the `macros.vm` file (line 2824).

XWiki Platform in all versions preceding 15.10.11, 16.4.1, and 16.5.0RC1

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

XWiki Platform contains an eval injection vulnerability that could allow any guest to perform arbitrary remote code execution through a request to SolrSearch.