XWiki Vulnerability Exploited in Cryptocurrency Mining Operation

A critical-severity vulnerability in the open source XWiki platform, tracked as CVE-2025-24893 with a CVSS score of 9.8, has been exploited in the wild as part of a low-end cryptocurrency mining operation, according to SecurityWeek. The flaw allows remote code execution by sending a crafted request to the SolrSearch macro, which uses the embedded Solr engine for full-text search, because the text parameter handling does not validate user input before a system call.

The vulnerability was reported by Trend Micro’s John Kwak in May 2024 and was addressed in XWiki versions 15.10.11, 16.4.1 and 16.5.0RC1 in June 2024, with an NVD advisory published in February 2025, according to ZDI advisory. PoC exploits have been available since early 2025, and VulnCheck observes in-the-wild attacks deploying a downloader in a two-pass workflow, with the second pass executing it after a gap of at least 20 minutes.

The observed traffic appears to originate from an IP address linked to other malicious activity, with exploits detected from a geolocated source in Vietnam.