CVE-2025-24893

Producto

XWiki / Platform

Vulnerabilidad

XWiki Platform Eval Injection Vulnerability

Añadido a KEV

30 oct 2025

Remediar antes de

20 nov 2025

Uso conocido en ransomware

No

Descripción resumida

XWiki Platform contains an eval injection vulnerability that could allow any guest to perform arbitrary remote code execution through a request to SolrSearch.

Acción requerida

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Notas

https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-rr6p-3pfg-562j ; https://nvd.nist.gov/vuln/detail/CVE-2025-24893