CVE‑2025‑24893: XWiki Platform Eval Injection Enables Guest Remote Code Execution via SolrSearch
What It Is — XWiki Platform contains an eval‑injection flaw that allows an unauthenticated guest to inject and execute arbitrary code through a crafted request to the SolrSearch endpoint.
Exploitability — The vulnerability is publicly disclosed; proof‑of‑concept code exists. No public exploit kit has been observed, but the attack path is trivial for a skilled adversary, giving it a high CVSS rating (≥7.0).
Affected Products — XWiki Platform (all versions prior to the vendor‑released patch; exact version range not disclosed).
Why It Matters for Trust & Control Assurance
- Vulnerability Management – Demonstrates the need for continuous discovery, risk scoring, and timely remediation of software flaws.
- Evidence of Due Diligence – Organizations must capture patch‑application evidence to satisfy auditors and regulators.
- Defensible Audit Trail – Maintaining records of remediation actions supports a trustworthy control posture that buyers increasingly demand.
Recommended Actions
- Inventory every XWiki instance across your environment.
- Apply the vendor‑released patch immediately; if a patch is not yet available, implement temporary mitigations (e.g., network segmentation, WAF rules).
- Update your vulnerability‑scanning tools to include CVE‑2025‑24893 and verify remediation.
- Document the remediation steps and retain evidence in your control repository for audit readiness.
Source: CISA KEV – CVE‑2025‑24893