CVE-2025-66474: xwiki-rendering Code Injection

Description

XWiki Rendering is a generic rendering system that converts textual input in a given syntax (wiki syntax, HTML, etc) into another syntax (XHTML, etc). Versions 16.10.9 and below, 17.0.0-rc-1 through 17.4.2 and 17.5.0-rc-1 through 17.5.0 have insufficient protection against {{/html}} injection, which attackers can exploit through RCE. Any user who can edit their own profile or any other document can execute arbitrary script macros, including Groovy and Python macros, which enable remote code execution as well as unrestricted read and write access to all wiki contents. This issue is fixed in versions 16.10.10, 17.4.3 and 17.6.0-rc-1.

Is your site exposed to CVE-2025-66474?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

8.8

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness Type (CWE)

CWE-95 CWE-95

CWE-94 CWE-94

Affected Products

Vendor	Product	Versions
xwiki	xwiki-rendering	< 16.10.10
xwiki	xwiki-rendering	17.0.0 — 17.4.3
xwiki	xwiki-rendering	All
xwiki	xwiki-rendering	All

References

Advisories & Patches

https://github.com/xwiki/xwiki-platform/commit/12b780ccd5bca5fc8f74f46648d7e02fa04fbc11 https://github.com/xwiki/xwiki-rendering/commit/9b71a2ee035815cfc29cebbfe81dbdd98f941d49 https://github.com/xwiki/xwiki-rendering/security/advisories/GHSA-9xc6-c2rm-f27p https://jira.xwiki.org/browse/XRENDERING-693 https://jira.xwiki.org/browse/XRENDERING-792 https://jira.xwiki.org/browse/XRENDERING-793 https://jira.xwiki.org/browse/XWIKI-23378 https://jira.xwiki.org/browse/XRENDERING-693 https://jira.xwiki.org/browse/XRENDERING-792 https://jira.xwiki.org/browse/XRENDERING-793

Exploits

https://jira.xwiki.org/browse/XRENDERING-693 https://jira.xwiki.org/browse/XRENDERING-792 https://jira.xwiki.org/browse/XRENDERING-793 https://jira.xwiki.org/browse/XRENDERING-693 https://jira.xwiki.org/browse/XRENDERING-792 https://jira.xwiki.org/browse/XRENDERING-793

Frequently Asked Questions

What is CVE-2025-66474? +

XWiki Rendering is a generic rendering system that converts textual input in a given syntax (wiki syntax, HTML, etc) into another syntax (XHTML, etc). Versions 16.10.9 and below, 17.0.0-rc-1 through 17.4.2 and 17.5.0-rc-1 through 17.5.0 have insufficient protection against {{/html}} injection, which attackers can exploit through RCE. Any user who can edit their own profile or any other document can execute arbitrary script macros, including Groovy and Python macros, which enable remote code execution as well as unrestricted read and write access to all wiki contents. This issue is fixed in versions 16.10.10, 17.4.3 and 17.6.0-rc-1. It has a CVSS v3.1 base score of 8.8 (HIGH).

How severe is CVE-2025-66474? +

CVE-2025-66474 has a CVSS v3.1 score of 8.8 out of 10, rated HIGH. This is a high-severity vulnerability that should be prioritized for patching.

What products are affected by CVE-2025-66474? +

CVE-2025-66474 affects products from xwiki, specifically: xwiki-rendering. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2025-66474? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2011-10033

The WordPress plugin is-human <= v1.4.2 contains an eval injection vulnerability in /is-human/engine.php that can be triggered via the 'type' …

CVE-2026-40187

In egroupware version 26.0 and earlier, an authenticated administrator can achieve OS-level Remote Code Execution (RCE) by uploading a malicious …

CVE-2025-58365

The XWiki blog application allows users of the XWiki platform to create and manage blog posts. Prior to version 9.14, …

CVE-2025-4318

The AWS Amplify Studio UI component property expressions in the aws-amplify/amplify-codegen-ui package lack input validation. This could potentially allow an …

CVE-2025-12140

The application contains an insecure 'redirectToUrl' mechanism that incorrectly processes the value of the 'redirectUrlParameter' parameter. The application interprets the …

CVE-2026-53875

picklescan before 1.0.3 contains a scanning bypass vulnerability in the scan_pytorch function that allows attackers to embed malicious magic numbers …