{"id":"CVE-2025-24893","kind":"vulnerability","aliases":["CVE-2025-24893"],"related":[],"title":"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it","description":"WAF Release - 2026-02-02 · Changelog\n\n# Changelog\n\nNew updates and improvements at Cloudflare.\n\nFebruary 2, 2026\n\n## WAF Release - 2026-02-02\n\nThis week’s release introduces new detections for CVE-2025-64459 and CVE-2025-24893.\n\nKey Findings\n\n- CVE-2025-64459: Django versions prior to 5.1.14, 5.2.8, and 4.2.26 are vulnerable to SQL injection via crafted dictionaries passed to QuerySet methods and the `Q()` class.\n- CVE-2025-24893: XWiki allows unauthenticated remote code execution through crafted requests to the SolrSearch endpoint, affecting the entire installation.\n\n| Ruleset | Rule ID | Legacy Rule ID | Description | Previous Action | New Action | Comments |\n| --- | --- | --- | --- | --- | --- | --- |\n| Cloudflare Managed Ruleset | ...30698ff3 | N/A | XWiki - Remote Code Execution - CVE:CVE-2025-24893 2 | Log | Block | This is a new detection. |\n| Cloudflare Managed Ruleset | ...da8ba7e6 | N/A | Django SQLI - CVE:CVE-2025-64459 | Log | Block | This is a new detection. |\n| Cloudflare Managed Ruleset | ...8d667511 | N/A | NoSQL, MongoDB - SQLi - Comparison - 2 | Block | Block | Rule metadata description refined. Detection unchanged. |","summary":"XWiki Platform has an eval injection flaw in its SolrSearch feature that lets an unauthenticated guest send a crafted request. An attacker gets remote code execution on the wiki server, and CISA lists it as actively exploited.","severity":"critical","cvss":9.8,"epss":null,"exploited":true,"exploited_at":"2025-10-30T00:00:00+00:00","products":[{"name":"XWiki Platform","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"xwiki","fixed":["15.10.11"],"affected":">= 5.4, < 15.10.11","ecosystem":"vendor"},{"name":"xwiki","fixed":["16.4.1"],"affected":">= 16.0.0, < 16.4.1","ecosystem":"vendor"},{"name":"xwiki","fixed":[],"affected":"= 5.3","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["cloudflare","exploited","lab-disclosure","other","self-hosted","xwiki"],"not_affected_if":["auth-required"],"how_to_check":null,"fix":"Apply the vendor mitigation or upgrade XWiki to a fixed release; the sources do not name the version. If no mitigation is available, discontinue use of the product per CISA guidance.","status":"open","published_at":"2025-02-20T20:15:46+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:44:25+00:00","updated_at":"2026-10-24T19:28:15+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-10-23T20:44:25Z","model":"claude-haiku-5-5","output":{"fix":"Apply the vendor mitigation or upgrade XWiki to a fixed release; the sources do not name the version. If no mitigation is available, discontinue use of the product per CISA guidance.","reach":"internet","summary":"XWiki Platform has an eval injection flaw in its SolrSearch feature that lets an unauthenticated guest send a crafted request. An attacker gets remote code execution on the wiki server, and CISA lists it as actively exploited.","category":"other","who_cares":["xwiki","self-hosted"],"confidence":0.7,"needs_auth":"no","worst_case":"Unauthenticated remote code execution on the XWiki server, with access to its data and secrets.","analyst_note":"Find the fixed XWiki versions and the vendor mitigation text for SolrSearch in the XWiki security advisory and the CISA KEV entry.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["auth-required"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000436,"input_tokens":2522,"output_tokens":367,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-02':77C,78C,93C,94C '-2025':17A,20A,104C,108C,113C,140C,182C,201C '-24893':18A,21A,109C,141C,183C '-64459':105C,114C,202C '2':88C,184C,219C '2026':76C,89C,92C '30698ff3':174C '4.2.26':122C '5.1.14':119C '5.2.8':120C '8d667511':213C 'action':167C,169C 'activ':72B 'affect':155C 'allow':143C 'applic':12A 'attack':58B 'block':186C,204C,220C,221C 'built':13A 'changelog':79C,80C 'cisa':68B 'class':138C 'cloudflar':27B,86C,171C,192C,210C 'code':61B,146C,178C 'comment':170C 'comparison':218C 'craft':55B,129C,149C 'cve':16A,19A,103C,107C,112C,139C,180C,181C,199C,200C 'da8ba7e6':195C 'descript':165C,224C 'detect':101C,191C,209C,226C 'dictionari':130C 'disclosur':31B 'django':115C,197C 'endpoint':154C 'entir':157C 'eval':41B 'execut':62B,147C,179C 'exploit':28B,73B 'featur':47B 'februari':87C 'find':111C 'flaw':43B 'generic':5A 'get':59B 'guest':52B 'host':35B 'id':161C,164C 'improv':84C 'inject':42B,127C 'instal':158C 'introduc':99C 'key':110C 'lab':30B 'lab-disclosur':29B 'legaci':162C 'let':49B 'list':69B 'log':185C,203C 'manag':172C,193C,211C 'metadata':223C 'method':134C 'mongodb':216C 'n/a':175C,196C,214C 'new':81C,100C,168C,190C,208C 'nosql':215C 'offer':8A 'pass':131C 'platform':2A,7A,23A,38B 'previous':166C 'prior':117C 'q':137C 'queryset':133C 'refin':225C 'releas':75C,91C,98C 'remot':60B,145C,177C 'request':56B,150C 'rule':160C,163C,222C 'ruleset':159C,173C,194C,212C 'runtim':9A 'self':34B 'self-host':33B 'send':53B 'server':66B 'servic':10A 'solrsearch':46B,153C 'sql':126C 'sqli':198C,217C 'top':15A 'unauthent':51B,144C 'unchang':227C 'updat':82C 'version':116C 'via':128C 'vulner':124C 'waf':74C,90C 'week':96C 'wiki':6A,65B 'xwiki':1A,22A,24A,25A,26A,36B,37B,142C,176C","nicknames":[],"mitigations":[{"kind":"waf-rule","scope":null,"since":"2026-02-02","covers":"HTTP requests proxied through Cloudflare matching the XWiki remote code execution detection in the Cloudflare Managed Ruleset (rule ...30698ff3), which changed from Log to Block","limits":"none stated","source":"https://developers.cloudflare.com/changelog/post/2026-02-02-waf-release/","vendor":"Cloudflare","seen_at":"2026-10-24T19:27:12Z","confidence":0.9,"source_title":"WAF Release - 2026-02-02 · Changelog","customer_action":"none stated beyond keeping the managed ruleset enabled; the upstream XWiki fix is not described as applied by this rule"}],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2025-02-20T20:15:46+00:00","kev":{"dateAdded":"2025-10-30","dueDate":"2025-11-20","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2025-24893","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-24893","severity":null,"published_at":"2025-10-30T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T14:39:38+00:00","note":null},{"source":"nvd","external_id":"CVE-2025-24893","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-24893","severity":null,"published_at":"2025-02-20T20:15:46+00:00","modified_at":"2026-06-17T08:59:47+00:00","first_seen_at":"2026-10-23T23:44:51+00:00","fetched_at":"2026-10-23T23:44:51+00:00","note":null},{"source":"lab","external_id":"https://developers.cloudflare.com/changelog/post/2026-02-02-waf-release/#CVE-2025-24893","url":"https://developers.cloudflare.com/changelog/post/2026-02-02-waf-release/","severity":null,"published_at":"2026-02-02T19:27:10+00:00","modified_at":null,"first_seen_at":"2026-10-24T19:28:15+00:00","fetched_at":"2026-10-24T19:28:15+00:00","note":"Cloudflare: WAF Release - 2026-02-02 · Changelog"}],"documents":[{"id":2942,"url":"https://developers.cloudflare.com/changelog/post/2026-02-02-waf-release/","title":"Cloudflare: WAF Release - 2026-02-02 · Changelog","kind":"advisory","source":"lab","text":"WAF Release - 2026-02-02 · Changelog\n\n# Changelog\n\nNew updates and improvements at Cloudflare.\n\nFebruary 2, 2026\n\n## WAF Release - 2026-02-02\n\nThis week’s release introduces new detections for CVE-2025-64459 and CVE-2025-24893.\n\nKey Findings\n\n- CVE-2025-64459: Django versions prior to 5.1.14, 5.2.8, and 4.2.26 are vulnerable to SQL injection via crafted dictionaries passed to QuerySet methods and the `Q()` class.\n- CVE-2025-24893: XWiki allows unauthenticated remote code execution through crafted requests to the SolrSearch endpoint, affecting the entire installation.\n\n| Ruleset | Rule ID | Legacy Rule ID | Description | Previous Action | New Action | Comments |\n| --- | --- | --- | --- | --- | --- | --- |\n| Cloudflare Managed Ruleset | ...30698ff3 | N/A | XWiki - Remote Code Execution - CVE:CVE-2025-24893 2 | Log | Block | This is a new detection. |\n| Cloudflare Managed Ruleset | ...da8ba7e6 | N/A | Django SQLI - CVE:CVE-2025-64459 | Log | Block | This is a new detection. |\n| Cloudflare Managed Ruleset | ...8d667511 | N/A | NoSQL, MongoDB - SQLi - Comparison - 2 | Block | Block | Rule metadata description refined. Detection unchanged. |","published_at":"2026-02-02T19:27:10+00:00","relation":"advisory","confidence":null,"note":"Cloudflare disclosure page"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}