CVE-2025-66474

HighCVSS 8.8

Published: 10/12/2025(UTC)Updated: 25/09/2026(UTC)Translated: 26/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

1.02%

62th percentile - higher than 62% of all known CVEs

Summary

XWiki Rendering is a generic rendering system that converts textual input in a given syntax (wiki syntax, HTML, etc.) into another syntax (XHTML, etc.). Versions 16.10.9 and below, 17.0.0-rc-1 through 17.4.2, and 17.5.0-rc-1 through 17.5.0 have insufficient protection against {{/html}} injection, which attackers can exploit through RCE. Any user who can edit their own profile or any other document can execute arbitrary script macros, including Groovy and Python macros, enabling remote code execution and unrestricted read/write access to all wiki contents.

Risk Assessment

A user with document editing privileges can execute arbitrary code on the server, gaining full access to wiki contents and the system. This leads to a serious breach of confidentiality, integrity, and availability.

Recommendation

Upgrade XWiki to version 16.10.10, 17.4.3, or 17.6.0-rc-1. Restrict document and profile editing to trusted users until the update is applied.

Other vulnerabilities in XWiki Rendering

CVE-2025-53837Critical
XWiki Rendering prior to 14.10.2 and 15.0 RC1 allows any user who can edit their profile or any document to execute arbitrary script macros, including Groovy and Python, leading to remote code execution. The rendering output is included as HTML macro content without further escaping, allowing closure of the HTML macro and injection of script macros with programming rights.

Original NVD description (English source)

XWiki Rendering is a generic rendering system that converts textual input in a given syntax (wiki syntax, HTML, etc) into another syntax (XHTML, etc). Versions 16.10.9 and below, 17.0.0-rc-1 through 17.4.2 and 17.5.0-rc-1 through 17.5.0 have insufficient protection against {{/html}} injection, which attackers can exploit through RCE. Any user who can edit their own profile or any other document can execute arbitrary script macros, including Groovy and Python macros, which enable remote code execution as well as unrestricted read and write access to all wiki contents. This issue is fixed in versions 16.10.10, 17.4.3 and 17.6.0-rc-1.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS