CVE-2025-24893 is an eval injection vulnerability in XWiki Platform. CISA added it to the Known Exploited Vulnerabilities catalogue on 30 October 2025, which means attackers have used it in real attacks. XWiki Platform contains an eval injection vulnerability that could allow any guest to perform arbitrary remote code execution through a request to SolrSearch.
How this vulnerability class works
An eval injection flaw is dangerous because it turns attacker-controlled input into executable code. In XWiki Platform, that means a guest request can cross the boundary from ordinary search or page interaction into server-side execution, which is a high-impact failure mode for any web application that exposes scripting or expression evaluation paths.
This pattern is especially severe when the vulnerable path sits behind normal application features, because defenders often expect the request to be harmless content, not code. Once an attacker can influence evaluation, the usual web application trust assumptions break down and the impact can extend from data access to full system compromise.
Why it matters in a collaboration platform
Wiki platforms concentrate knowledge, user-generated content, integrations and administrative workflows in one place, so a remote code execution bug can affect more than a single page. If an attacker can reach a code execution path through a search endpoint, they may be able to read application data, tamper with content, pivot into connected services or establish persistence.
For this reason, readers should treat the vendor advisory and the CVE Program record as the authoritative starting point for record-level identification, and consult the NIST National Vulnerability Database for the broader vulnerability entry and related metadata.
Exposure and remediation considerations
Organisations should confirm whether XWiki Platform is present anywhere in their asset inventory, whether the service is internet-facing, and whether any reverse proxy, WAF or application gateway can see the affected request path. Because this is an exploited vulnerability, exposure review should also include hosted instances, internal test systems and forgotten development environments that may still be reachable from trusted networks.
When patching cannot happen immediately, compensating controls should focus on reducing reachability of the vulnerable endpoint, restricting who can submit requests to the application, and monitoring for suspicious use of the affected search functionality. Vulnerability management guidance is useful here because the practical problem is not only installation, but also prioritisation, exception handling and verification after change.
Detection and post-exploitation review
After remediation, defenders should look for signs that the exploit was used before the patch was applied. For an eval injection issue, that means reviewing web logs, application logs and system telemetry for unusual requests to SolrSearch, unexpected child processes, new files, abnormal outbound connections and any evidence that the application server executed commands it should never run.
Post-patch review matters because code execution can leave behind more than the original vulnerability. If compromise occurred, the organisation may need to rotate application secrets, session material and any service credentials reachable from the XWiki host, then validate that persistence mechanisms were not planted on the server or in connected infrastructure.
Risk and Threat Considerations
This vulnerability is high-risk because it combines remote code execution with a low-friction entry point that can be reachable by an unprivileged guest. Once a search request becomes executable input, attackers can use the platform as a foothold for data theft, persistence or lateral movement.
Failure mechanism: The application evaluates attacker-controlled content in a server-side code path, so a normal request can trigger arbitrary command execution.
Impact: Successful exploitation can lead to full server compromise, theft of application data, credential abuse and follow-on access to adjacent systems.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP ASVS, NIST SP 800-53 Rev 5, CIS Controls v8 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP ASVS | V15 — Secure Architecture | Eval injection is an application architecture flaw that breaks trust boundaries. |
| Recommendation — Remove server-side evaluation of untrusted input and redesign the code path to avoid executable content. | ||
| NIST SP 800-53 Rev 5 | SI-10 — Information Input Validation | The flaw exists because unsafe input reaches an execution path in the application. |
| SI-4 — System Monitoring | Exploitation requires detection of unusual execution, process creation and outbound activity. | |
| Recommendation — Validate and constrain input before it reaches search or expression-evaluation logic. Monitor application and host telemetry for command execution, abnormal child processes and suspicious egress. | ||
| CIS Controls v8 | CIS-7 — Continuous Vulnerability Management | The term names an exploited CVE that needs asset discovery, prioritisation and remediation tracking. |
| Recommendation — Inventory affected systems, prioritise the CVE for remediation and verify closure after patching. | ||
| NIST CSF 2.0 | PR.IP-12 — Vulnerability Management | The vulnerability requires coordinated remediation, exception handling and verification across the environment. |
| Recommendation — Track the exposed XWiki instance through vulnerability management until remediation and validation are complete. | ||
Practitioner Guidance
Why practitioners should care: Treat exploited web application RCE as both an application security issue and an incident response problem. The immediate question is not only whether the patch is available, but whether the exposed endpoint was reachable long enough for attackers to use it.
What to watch for: Validate the XWiki deployment path, then review security telemetry for signs of post-exploitation activity, especially anything that indicates the server executed unexpected commands or reached out to unfamiliar hosts. If compromise is suspected, rebuild or reimage rather than assuming removal of the CVE alone is enough.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 17, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org