CVE-2025-66474

Technical Details

The vulnerability stems from insufficient input sanitization within the XWiki Rendering component when handling {{/html}} tags. An attacker can inject malicious code within these tags, which, when processed by the rendering engine, can lead to the execution of arbitrary script macros. Specifically, the vulnerability allows the execution of Groovy and Python macros, granting the attacker the ability to execute arbitrary code on the server. This includes unrestricted read and write access to all wiki contents, effectively compromising the entire XWiki instance. The root cause is the failure to properly escape or sanitize user-supplied input before it is processed by the rendering engine, allowing the attacker to bypass security checks and inject malicious code.

The attack vector involves exploiting the ability of users to edit their profiles or other documents within the XWiki instance. By injecting malicious code into these editable areas, an attacker can trigger the vulnerability when the document is rendered. This can be achieved through various means, such as crafting a malicious profile or injecting code into a wiki page that is frequently viewed by other users. The injected code is then executed when the affected XWiki instance renders the content, leading to remote code execution.