{"id":"CVE-2025-24893","aliases":["EUVD-2025-4562","GHSA-rr6p-3pfg-562j"],"status":"published","title":"Remote code execution as guest via SolrSearchMacros request in xwiki","description":"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any guest can perform arbitrary remote code execution through a request to `SolrSearch`. This impacts the confidentiality, integrity and availability of the whole XWiki installation. To reproduce on an instance, without being logged in, go to `\u003chost\u003e/xwiki/bin/get/Main/SolrSearch?media=rss\u0026text=%7D%7D%7D%7B%7Basync%20async%3Dfalse%7D%7D%7B%7Bgroovy%7D%7Dprintln%28\"Hello%20from\"%20%2B%20\"%20search%20text%3A\"%20%2B%20%2823%20%2B%2019%29%29%7B%7B%2Fgroovy%7D%7D%7B%7B%2Fasync%7D%7D%20`. If there is an output, and the title of the RSS feed contains `Hello from search text:42`, then the instance is vulnerable. This vulnerability has been patched in XWiki 15.10.11, 16.4.1 and 16.5.0RC1. Users are advised to upgrade. Users unable to upgrade may edit `Main.SolrSearchMacros` in `SolrSearchMacros.xml` on line 955 to match the `rawResponse` macro in `macros.vm#L2824` with a content type of `application/xml`, instead of simply outputting the content of the feed.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.99974,"percentile":0.99978,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":true,"fix_available":true},"cwes":["CWE-94","CWE-95"],"published":"2025-02-20T19:19:10Z","modified":"2026-10-28T10:51:30Z","kev":{"date_added":"2025-10-30","due_date":"2025-11-20","required_action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","known_ransomware_use":"Unknown"},"exploitation":[{"source":"euvd","since":"2025-10-30"},{"source":"kev","since":"2025-10-30"}],"exploits":[{"source":"metasploit","id":"exploit/multi/http/xwiki_unauth_rce_cve_2025_24893","title":"Remote Code Execution Vulnerability in XWiki Platform (CVE-2025-24893)","type":"exploit","platform":"Linux,Unix,Windows","date":"2025-02-20","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/multi/http/xwiki_unauth_rce_cve_2025_24893"},{"source":"pocgithub","id":"iSee857/CVE-2025-24893-PoC","title":"iSee857/CVE-2025-24893-PoC","date":"2025-02-25","url":"https://github.com/iSee857/CVE-2025-24893-PoC"},{"source":"exploitdb","id":"EDB-52136","title":"XWiki Platform 15.10.10 - Remote Code Execution","type":"webapps","platform":"multiple","date":"2025-04-07","url":"https://www.exploit-db.com/exploits/52136"},{"source":"pocgithub","id":"Artemir7/CVE-2025-24893-EXP","title":"Artemir7/CVE-2025-24893-EXP","date":"2025-05-05","url":"https://github.com/Artemir7/CVE-2025-24893-EXP"},{"source":"pocgithub","id":"AliElKhatteb/CVE-2024-32019-POC","title":"AliElKhatteb/CVE-2024-32019-POC","date":"2025-08-03","url":"https://github.com/AliElKhatteb/CVE-2024-32019-POC"},{"source":"pocgithub","id":"AzureADTrent/CVE-2025-24893-Reverse-Shell","title":"AzureADTrent/CVE-2025-24893-Reverse-Shell","date":"2025-08-03","url":"https://github.com/AzureADTrent/CVE-2025-24893-Reverse-Shell"},{"source":"pocgithub","id":"Infinit3i/CVE-2025-24893","title":"Infinit3i/CVE-2025-24893","date":"2025-08-03","url":"https://github.com/Infinit3i/CVE-2025-24893"},{"source":"pocgithub","id":"dhiaZnaidi/CVE-2025-24893-PoC","title":"dhiaZnaidi/CVE-2025-24893-PoC","date":"2025-08-03","url":"https://github.com/dhiaZnaidi/CVE-2025-24893-PoC"},{"source":"pocgithub","id":"gmh5225/CVE-2025-24893-RCE-PoC","title":"gmh5225/CVE-2025-24893-RCE-PoC","date":"2025-08-03","url":"https://github.com/gmh5225/CVE-2025-24893-RCE-PoC"},{"source":"pocgithub","id":"hackersonsteroids/cve-2025-24893","title":"hackersonsteroids/cve-2025-24893","date":"2025-08-03","url":"https://github.com/hackersonsteroids/cve-2025-24893"},{"source":"pocgithub","id":"dollarboysushil/CVE-2025-24893-XWiki-Unauthenticated-RCE-Exploit-POC","title":"dollarboysushil/CVE-2025-24893-XWiki-Unauthenticated-RCE-Exploit-POC","date":"2025-08-04","url":"https://github.com/dollarboysushil/CVE-2025-24893-XWiki-Unauthenticated-RCE-Exploit-POC"},{"source":"pocgithub","id":"gunzf0x/CVE-2025-24893","title":"gunzf0x/CVE-2025-24893","date":"2025-08-04","url":"https://github.com/gunzf0x/CVE-2025-24893"},{"source":"pocgithub","id":"investigato/cve-2025-24893-poc","title":"investigato/cve-2025-24893-poc","date":"2025-08-05","url":"https://github.com/investigato/cve-2025-24893-poc"},{"source":"pocgithub","id":"zs1n/CVE-2025-24893","title":"zs1n/CVE-2025-24893","date":"2025-08-05","url":"https://github.com/zs1n/CVE-2025-24893"},{"source":"pocgithub","id":"570RMBR3AK3R/xwiki-cve-2025-24893-poc","title":"570RMBR3AK3R/xwiki-cve-2025-24893-poc","date":"2025-08-06","url":"https://github.com/570RMBR3AK3R/xwiki-cve-2025-24893-poc"},{"source":"pocgithub","id":"IIIeJlyXaKapToIIIKu/CVE-2025-24893-XWiki-unauthenticated-RCE-via-SolrSearch","title":"IIIeJlyXaKapToIIIKu/CVE-2025-24893-XWiki-unauthenticated-RCE-via-SolrSearch","date":"2025-08-07","url":"https://github.com/IIIeJlyXaKapToIIIKu/CVE-2025-24893-XWiki-unauthenticated-RCE-via-SolrSearch"},{"source":"pocgithub","id":"Th3Gl0w/CVE-2025-24893-POC","title":"Th3Gl0w/CVE-2025-24893-POC","date":"2025-08-07","url":"https://github.com/Th3Gl0w/CVE-2025-24893-POC"},{"source":"pocgithub","id":"mah4nzfr/CVE-2025-24893","title":"mah4nzfr/CVE-2025-24893","date":"2025-08-07","url":"https://github.com/mah4nzfr/CVE-2025-24893"},{"source":"pocgithub","id":"Hex00-0x4/CVE-2025-24893-XWiki-RCE","title":"Hex00-0x4/CVE-2025-24893-XWiki-RCE","date":"2025-08-08","url":"https://github.com/Hex00-0x4/CVE-2025-24893-XWiki-RCE"},{"source":"pocgithub","id":"The-Red-Serpent/CVE-2025-24893","title":"The-Red-Serpent/CVE-2025-24893","date":"2025-08-08","url":"https://github.com/The-Red-Serpent/CVE-2025-24893"},{"source":"pocgithub","id":"alaxar/CVE-2025-24893","title":"alaxar/CVE-2025-24893","date":"2025-08-08","url":"https://github.com/alaxar/CVE-2025-24893"},{"source":"pocgithub","id":"D3Ext/CVE-2025-24893","title":"D3Ext/CVE-2025-24893","date":"2025-08-09","url":"https://github.com/D3Ext/CVE-2025-24893"},{"source":"pocgithub","id":"Retro023/CVE-2025-24893-POC","title":"Retro023/CVE-2025-24893-POC","date":"2025-08-09","url":"https://github.com/Retro023/CVE-2025-24893-POC"},{"source":"pocgithub","id":"CMassa/CVE-2025-24893","title":"CMassa/CVE-2025-24893","date":"2025-08-13","url":"https://github.com/CMassa/CVE-2025-24893"},{"source":"pocgithub","id":"x0da6h/POC-for-CVE-2025-24893","title":"x0da6h/POC-for-CVE-2025-24893","date":"2025-08-22","url":"https://github.com/x0da6h/POC-for-CVE-2025-24893"},{"source":"pocgithub","id":"ibadovulfat/CVE-2025-24893","title":"ibadovulfat/CVE-2025-24893","date":"2025-08-26","url":"https://github.com/ibadovulfat/CVE-2025-24893"},{"source":"pocgithub","id":"torjan0/xwiki_solrsearch-rce-exploit","title":"torjan0/xwiki_solrsearch-rce-exploit","date":"2025-08-26","url":"https://github.com/torjan0/xwiki_solrsearch-rce-exploit"},{"source":"exploitdb","id":"EDB-52429","title":"XWiki Platform 15.10.10 - Metasploit Module for Remote Code Execution (RCE)","type":"webapps","platform":"multiple","date":"2025-09-16","url":"https://www.exploit-db.com/exploits/52429"},{"source":"nuclei","id":"CVE-2025-24893","title":"XWiki Platform - Remote Code Execution","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-24893.yaml"}],"exploits_more":20,"fixes":[{"ecosystem":"Maven","package":"org.xwiki.platform:xwiki-platform-search-solr-ui","fixed_in":["15.10.11","16.4.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.xwiki.platform:xwiki-platform-search-solr-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3-milestone-2"},{"fixed":"15.10.11"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.xwiki.platform:xwiki-platform-search-solr-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.0.0-rc-1"},{"fixed":"16.4.1"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.xwiki.platform:xwiki-platform-search-solr-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3-milestone-2"},{"fixed":"15.10.11"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.xwiki.platform:xwiki-platform-search-solr-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.0.0-rc-1"},{"fixed":"16.4.1"}]}]}],"products":[{"vendor":"xwiki","product":"platform"},{"vendor":"xwiki","product":"xwiki"},{"vendor":"xwiki","product":"xwiki-platform"}],"references":[{"url":"https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-rr6p-3pfg-562j","tags":["x_refsource_CONFIRM","Vendor Advisory","advisory","web"]},{"url":"https://github.com/xwiki/xwiki-platform/commit/67021db9b8ed26c2236a653269302a86bf01ef40","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://github.com/xwiki/xwiki-platform/blob/568447cad5172d97d6bbcfda9f6183689c2cf086/xwiki-platform-core/xwiki-platform-search/xwiki-platform-search-solr/xwiki-platform-search-solr-ui/src/main/resources/Main/SolrSearchMacros.xml#L955","tags":["x_refsource_MISC","Product","web"]},{"url":"https://github.com/xwiki/xwiki-platform/blob/67021db9b8ed26c2236a653269302a86bf01ef40/xwiki-platform-core/xwiki-platform-web/xwiki-platform-web-templates/src/main/resources/templates/macros.vm#L2824","tags":["x_refsource_MISC","Product","web"]},{"url":"https://jira.xwiki.org/browse/XWIKI-22149","tags":["x_refsource_MISC","Exploit","Issue Tracking","Vendor Advisory","web"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-24893","tags":["government-resource","US Government Resource","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-24893","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-rr6p-3pfg-562j"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/24xxx/CVE-2025-24893.json","tags":["advisory"]},{"url":"https://github.com/xwiki/xwiki-platform","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2025-24893","title":"Remote code execution as guest via SolrSearchMacros request in xwiki","description":"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any guest can perform arbitrary remote code execution through a request to `SolrSearch`. This impacts the confidentiality, integrity and availability of the whole XWiki installation. To reproduce on an instance, without being logged in, go to `\u003chost\u003e/xwiki/bin/get/Main/SolrSearch?media=rss\u0026text=%7D%7D%7D%7B%7Basync%20async%3Dfalse%7D%7D%7B%7Bgroovy%7D%7Dprintln%28\"Hello%20from\"%20%2B%20\"%20search%20text%3A\"%20%2B%20%2823%20%2B%2019%29%29%7B%7B%2Fgroovy%7D%7D%7B%7B%2Fasync%7D%7D%20`. If there is an output, and the title of the RSS feed contains `Hello from search text:42`, then the instance is vulnerable. This vulnerability has been patched in XWiki 15.10.11, 16.4.1 and 16.5.0RC1. Users are advised to upgrade. Users unable to upgrade may edit `Main.SolrSearchMacros` in `SolrSearchMacros.xml` on line 955 to match the `rawResponse` macro in `macros.vm#L2824` with a content type of `application/xml`, instead of simply outputting the content of the feed.","status":"published","published":"2025-02-20T19:19:10.597Z","modified":"2026-02-26T19:08:47.744Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-95"],"updated_at":"2026-11-02T14:32:43.770144Z"}],"euvd":[{"id":"EUVD-2025-4562","description":"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any guest can perform arbitrary remote code execution through a request to `SolrSearch`. This impacts the confidentiality, integrity and availability of the whole XWiki installation. To reproduce on an instance, without being logged in, go to `\u003chost\u003e/xwiki/bin/get/Main/SolrSearch?media=rss\u0026text=%7D%7D%7D%7B%7Basync%20async%3Dfalse%7D%7D%7B%7Bgroovy%7D%7Dprintln%28\"Hello%20from\"%20%2B%20\"%20search%20text%3A\"%20%2B%20%2823%20%2B%2019%29%29%7B%7B%2Fgroovy%7D%7D%7B%7B%2Fasync%7D%7D%20`. If there is an output, and the title of the RSS feed contains `Hello from search text:42`, then the instance is vulnerable. This vulnerability has been patched in XWiki 15.10.11, 16.4.1 and 16.5.0RC1. Users are advised to upgrade. Users unable to upgrade may edit `Main.SolrSearchMacros` in `SolrSearchMacros.xml` on line 955 to match the `rawResponse` macro in `macros.vm#L2824` with a content type of `application/xml`, instead of simply outputting the content of the feed.","status":"published","published":"2025-02-20T19:19:10Z","modified":"2026-02-26T19:08:47Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"exploited_since":"2025-10-30","updated_at":"2026-11-02T19:48:16.381292Z"}],"ghsa":[{"id":"GHSA-rr6p-3pfg-562j","title":"XWiki Platform allows remote code execution as guest via SolrSearchMacros request","description":"### Impact\nAny guest can perform arbitrary remote code execution through a request to `SolrSearch`. This impacts the confidentiality, integrity and availability of the whole XWiki installation.\n\nTo reproduce on an instance, without being logged in, go to `\u003chost\u003e/xwiki/bin/get/Main/SolrSearch?media=rss\u0026text=%7D%7D%7D%7B%7Basync%20async%3Dfalse%7D%7D%7B%7Bgroovy%7D%7Dprintln%28\"Hello%20from\"%20%2B%20\"%20search%20text%3A\"%20%2B%20%2823%20%2B%2019%29%29%7B%7B%2Fgroovy%7D%7D%7B%7B%2Fasync%7D%7D%20`. If there is an output, and the title of the RSS feed contains `Hello from search text:42`, then the instance is vulnerable.\n\n### Patches\nThis vulnerability has been patched in XWiki 15.10.11, 16.4.1 and 16.5.0RC1.\n\n### Workarounds\n[This line](https://github.com/xwiki/xwiki-platform/blob/568447cad5172d97d6bbcfda9f6183689c2cf086/xwiki-platform-core/xwiki-platform-search/xwiki-platform-search-solr/xwiki-platform-search-solr-ui/src/main/resources/Main/SolrSearchMacros.xml#L955) in `Main.SolrSearchMacros` can be edited to match the `rawResponse` macro defined [here](https://github.com/xwiki/xwiki-platform/blob/67021db9b8ed26c2236a653269302a86bf01ef40/xwiki-platform-core/xwiki-platform-web/xwiki-platform-web-templates/src/main/resources/templates/macros.vm#L2824) with a content type of `application/xml`, instead of simply outputting the content of the feed.\n\n### References\n\n* https://jira.xwiki.org/browse/XWIKI-22149\n* https://github.com/xwiki/xwiki-platform/commit/67021db9b8ed26c2236a653269302a86bf01ef40\n\n### Attribution\nThis vulnerability has been reported by John Kwak for Trend Micro's Zero Day Initiative.","status":"published","published":"2025-02-20T20:16:21Z","modified":"2025-10-30T19:54:05Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-94","CWE-95"],"updated_at":"2026-11-02T14:39:04.350802Z"}],"kev":[{"id":"CVE-2025-24893","title":"XWiki Platform Eval Injection Vulnerability","description":"XWiki Platform contains an eval injection vulnerability that could allow any guest to perform arbitrary remote code execution through a request to SolrSearch.","cwes":["CWE-95"],"kev":{"date_added":"2025-10-30","due_date":"2025-11-20","required_action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","known_ransomware_use":"Unknown"},"updated_at":"2026-11-02T17:00:15.999436Z"}],"nvd":[{"id":"CVE-2025-24893","description":"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any guest can perform arbitrary remote code execution through a request to `SolrSearch`. This impacts the confidentiality, integrity and availability of the whole XWiki installation. To reproduce on an instance, without being logged in, go to `\u003chost\u003e/xwiki/bin/get/Main/SolrSearch?media=rss\u0026text=%7D%7D%7D%7B%7Basync%20async%3Dfalse%7D%7D%7B%7Bgroovy%7D%7Dprintln%28\"Hello%20from\"%20%2B%20\"%20search%20text%3A\"%20%2B%20%2823%20%2B%2019%29%29%7B%7B%2Fgroovy%7D%7D%7B%7B%2Fasync%7D%7D%20`. If there is an output, and the title of the RSS feed contains `Hello from search text:42`, then the instance is vulnerable. This vulnerability has been patched in XWiki 15.10.11, 16.4.1 and 16.5.0RC1. Users are advised to upgrade. Users unable to upgrade may edit `Main.SolrSearchMacros` in `SolrSearchMacros.xml` on line 955 to match the `rawResponse` macro in `macros.vm#L2824` with a content type of `application/xml`, instead of simply outputting the content of the feed.","status":"published","published":"2025-02-20T20:15:46.697Z","modified":"2026-06-17T08:59:47.94Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-95","CWE-94"],"updated_at":"2026-11-02T14:10:51.871789Z"}],"osv":[{"id":"CVE-2025-24893","title":"Remote code execution as guest via SolrSearchMacros request in xwiki","description":"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any guest can perform arbitrary remote code execution through a request to `SolrSearch`. This impacts the confidentiality, integrity and availability of the whole XWiki installation. To reproduce on an instance, without being logged in, go to `\u003chost\u003e/xwiki/bin/get/Main/SolrSearch?media=rss\u0026text=%7D%7D%7D%7B%7Basync%20async%3Dfalse%7D%7D%7B%7Bgroovy%7D%7Dprintln%28\"Hello%20from\"%20%2B%20\"%20search%20text%3A\"%20%2B%20%2823%20%2B%2019%29%29%7B%7B%2Fgroovy%7D%7D%7B%7B%2Fasync%7D%7D%20`. If there is an output, and the title of the RSS feed contains `Hello from search text:42`, then the instance is vulnerable. This vulnerability has been patched in XWiki 15.10.11, 16.4.1 and 16.5.0RC1. Users are advised to upgrade. Users unable to upgrade may edit `Main.SolrSearchMacros` in `SolrSearchMacros.xml` on line 955 to match the `rawResponse` macro in `macros.vm#L2824` with a content type of `application/xml`, instead of simply outputting the content of the feed.","status":"published","published":"2025-02-20T19:19:10.597Z","modified":"2026-11-11T13:28:43.536823285Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-95"],"updated_at":"2026-11-11T03:22:28.447808Z"},{"id":"GHSA-rr6p-3pfg-562j","title":"XWiki Platform allows remote code execution as guest via SolrSearchMacros request","description":"### Impact\nAny guest can perform arbitrary remote code execution through a request to `SolrSearch`. This impacts the confidentiality, integrity and availability of the whole XWiki installation.\n\nTo reproduce on an instance, without being logged in, go to `\u003chost\u003e/xwiki/bin/get/Main/SolrSearch?media=rss\u0026text=%7D%7D%7D%7B%7Basync%20async%3Dfalse%7D%7D%7B%7Bgroovy%7D%7Dprintln%28\"Hello%20from\"%20%2B%20\"%20search%20text%3A\"%20%2B%20%2823%20%2B%2019%29%29%7B%7B%2Fgroovy%7D%7D%7B%7B%2Fasync%7D%7D%20`. If there is an output, and the title of the RSS feed contains `Hello from search text:42`, then the instance is vulnerable.\n\n### Patches\nThis vulnerability has been patched in XWiki 15.10.11, 16.4.1 and 16.5.0RC1.\n\n### Workarounds\n[This line](https://github.com/xwiki/xwiki-platform/blob/568447cad5172d97d6bbcfda9f6183689c2cf086/xwiki-platform-core/xwiki-platform-search/xwiki-platform-search-solr/xwiki-platform-search-solr-ui/src/main/resources/Main/SolrSearchMacros.xml#L955) in `Main.SolrSearchMacros` can be edited to match the `rawResponse` macro defined [here](https://github.com/xwiki/xwiki-platform/blob/67021db9b8ed26c2236a653269302a86bf01ef40/xwiki-platform-core/xwiki-platform-web/xwiki-platform-web-templates/src/main/resources/templates/macros.vm#L2824) with a content type of `application/xml`, instead of simply outputting the content of the feed.\n\n### References\n\n* https://jira.xwiki.org/browse/XWIKI-22149\n* https://github.com/xwiki/xwiki-platform/commit/67021db9b8ed26c2236a653269302a86bf01ef40\n\n### Attribution\nThis vulnerability has been reported by John Kwak for Trend Micro's Zero Day Initiative.","status":"published","published":"2025-02-20T20:16:21Z","modified":"2025-10-30T19:54:04Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-94","CWE-95"],"updated_at":"2026-11-02T15:46:56.281047Z"}]}}