XWiki Platform Eval Injection Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 30/10/2025. Patch affected systems as an emergency.
| Package | Affected versions | Patched versions |
|---|---|---|
| org.xwiki.platform:xwiki-platform-search-solr-ui | ≥ 16.0.0-rc-1, < 16.4.1≥ 5.3-milestone-2, < 15.10.11 | 16.4.115.10.11 |
| xwiki | = 5.3≥ 16.0.0, < 16.4.1≥ 5.4, < 15.10.11 | 16.4.115.10.11 |
Any guest can perform arbitrary remote code execution through a request to SolrSearch. This impacts the confidentiality, integrity and availability of the whole XWiki installation.
To reproduce on an instance, without being logged in, go to <host>/xwiki/bin/get/Main/SolrSearch?media=rss&text=%7D%7D%7D%7B%7Basync%20async%3Dfalse%7D%7D%7B%7Bgroovy%7D%7Dprintln%28"Hello%20from"%20%2B%20"%20search%20text%3A"%20%2B%20%2823%20%2B%2019%29%29%7B%7B%2Fgroovy%7D%7D%7B%7B%2Fasync%7D%7D%20. If there is an output, and the title of the RSS feed contains Hello from search text:42, then the instance is vulnerable.
This vulnerability has been patched in XWiki 15.10.11, 16.4.1 and 16.5.0RC1.
This line in can be edited to match the macro defined with a content type of , instead of simply outputting the content of the feed.
Main.SolrSearchMacrosrawResponseapplication/xmlThis vulnerability has been reported by John Kwak for Trend Micro's Zero Day Initiative.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free