CVE-2025-24893 XWiki 存在远程代码执行漏洞

Description

PoC

None yet. Search at https://trap.biu.life/?ref=rss

References

• https://nvd.nist.gov/vuln/detail/CVE-2025-24893
• https://www.vulncheck.com/blog/xwiki-cve-2025-24893-eitw
• https://github.com/rippsec/CVE-2025-24893-XWiki-SSTI-RCE
• https://www.rapid7.com/db/modules/exploit/multi/http/xwiki_unauth_rce_cve_2025_24893/
• https://www.exploit-db.com/exploits/52429
• https://isc.sans.edu/diary/32444
• https://www.offsec.com/blog/cve-2025-24893/
• https://www.tenable.com/plugins/was/114912
• https://github.com/D3Ext/CVE-2025-24893
• https://www.ionix.io/blog/xwiki-remote-code-execution-vulnerability-cve-2025-24893/

Related Vulnerabilities

• XWiki Platform /xwiki/bin/skin/ 目录遍历漏洞（CVE-2026-34151）
• XWiki /xwiki/rest/liveData/sources/liveTable/entries SQL 注入漏洞（CVE-2025-32429）
• XWiki /bin/jsx/Main/WebHome 目录遍历漏洞（CVE-2026-23734）
• PoCCVE-2026-40105: XWiki - Cross-Site Scripting
• XWiki存在XSS漏洞(CVE-2026-40105)
• PoCCVE-2026-24128: XWiki Platform Distribution Flavor Main - Cross-Site Scripting
• PoCCVE-2025-66472: XWiki DeleteApplication - Cross-Site Scripting
• PoCCVE-2025-55749: XWiki - Information Disclosure
• XWiki Jetty /webapps/xwiki/WEB-INF/web.xml 文件读取漏洞（CVE-2025-55749）
• XWiki Platform 文件读取漏洞(CVE-2025-55749)
• XWiki /rest/wikis/xwiki/query SQL 注入漏洞（CVE-2025-32969）