{"id":"CVE-2025-66474","summary":"XWiki vulnerable to remote code execution through insufficient protection against {{/html}} injection","details":"XWiki Rendering is a generic rendering system that converts textual input in a given syntax (wiki syntax, HTML, etc) into another syntax (XHTML, etc). Versions 16.10.9 and below, 17.0.0-rc-1 through 17.4.2 and 17.5.0-rc-1 through 17.5.0 have insufficient protection against {{/html}} injection, which attackers can exploit through RCE. Any user who can edit their own profile or any other document can execute arbitrary script macros, including Groovy and Python macros, which enable remote code execution as well as unrestricted read and write access to all wiki contents. This issue is fixed in versions 16.10.10, 17.4.3 and 17.6.0-rc-1.","aliases":["GHSA-9xc6-c2rm-f27p"],"modified":"2026-08-12T15:14:40.759309Z","published":"2025-12-10T21:59:58.727Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-95"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66474.json"},"references":[{"type":"WEB","url":"https://jira.xwiki.org/browse/XRENDERING-693"},{"type":"WEB","url":"https://jira.xwiki.org/browse/XRENDERING-792"},{"type":"WEB","url":"https://jira.xwiki.org/browse/XRENDERING-793"},{"type":"WEB","url":"https://jira.xwiki.org/browse/XWIKI-23378"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66474.json"},{"type":"ADVISORY","url":"https://github.com/xwiki/xwiki-rendering/security/advisories/GHSA-9xc6-c2rm-f27p"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-66474"},{"type":"FIX","url":"https://github.com/xwiki/xwiki-platform/commit/12b780ccd5bca5fc8f74f46648d7e02fa04fbc11"},{"type":"FIX","url":"https://github.com/xwiki/xwiki-rendering/commit/9b71a2ee035815cfc29cebbfe81dbdd98f941d49"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/xwiki/xwiki-platform","events":[{"introduced":"0"},{"introduced":"445c0831fb8cf5610eda0eb58225890cb2bece6c"},{"fixed":"aa2cc23219a3df3fc651360b00769e0332b2a305"},{"fixed":"046f3c5d6352c4eab77e63e4ce015b4f036b845b"},{"fixed":"f299dd468c70239065e3aa39d0f7c41b7a982d80"},{"fixed":"12b780ccd5bca5fc8f74f46648d7e02fa04fbc11"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"16.10.10"},{"introduced":"17.5.0-rc-1"},{"fixed":"17.6.0-rc-1"},{"introduced":"17.0.0-rc-1"},{"fixed":"17.4.3"}],"source":["AFFECTED_FIELD","REFERENCES"]}},{"type":"GIT","repo":"https://github.com/xwiki/xwiki-rendering","events":[{"introduced":"0"},{"fixed":"8178ad7ace0976c3dd7c0805eabe6cef9c19478d"},{"introduced":"67dcde0d7364d23e8cde16e9a8550e0365515be9"},{"fixed":"c21cbc76976ad6cc28437de7a928aebeee01c9c5"},{"introduced":"03076d9a7a4264fee8a201667dbdb8a8fbfb5737"},{"fixed":"9b71a2ee035815cfc29cebbfe81dbdd98f941d49"}],"database_specific":{"cpe":["cpe:2.3:a:xwiki:xwiki-rendering:*:*:*:*:*:*:*:*","cpe:2.3:a:xwiki:xwiki-rendering:17.5.0:-:*:*:*:*:*:*"],"extracted_events":[{"introduced":"0"},{"fixed":"16.10.10"},{"introduced":"17.0.0"},{"fixed":"17.4.3"},{"introduced":"17.5.0-NA"},{"last_affected":"17.5.0-NA"}],"source":["CPE_RANGE","CPE_STRING","REFERENCES"]}}],"versions":["17.5.0-NA","xwiki-platform-17.4.2","xwiki-platform-16.10.9","xwiki-platform-17.4.0","xwiki-platform-17.4.0-rc-1","xwiki-platform-16.10.8","xwiki-platform-16.10.7","xwiki-platform-16.10.6","xwiki-platform-16.10.5","xwiki-platform-16.10.4","xwiki-platform-16.10.3","xwiki-platform-16.10.2","xwiki-platform-16.10.1","xwiki-platform-16.10.0","xwiki-platform-16.10.0-rc-1","xwiki-platform-9.9-rc-2","xwiki-platform-8.3-milestone-1","xwiki-platform-8.2-milestone-2","xwiki-platform-8.2-milestone-1","xwiki-platform-8.1-milestone-2","xwiki-platform-8.1-milestone-1","xwiki-platform-8.0-milestone-2","xwiki-platform-8.0-milestone-1","xwiki-platform-7.4-milestone-2","xwiki-platform-7.4-milestone-1","xwiki-platform-7.3-milestone-2","xwiki-rendering-17.4.2","xwiki-rendering-16.10.9","xwiki-rendering-17.4.1","xwiki-rendering-17.4.0","xwiki-rendering-17.4.0-rc-1","xwiki-rendering-16.10.8","xwiki-rendering-16.10.7","xwiki-rendering-16.10.6","xwiki-rendering-16.10.5","xwiki-rendering-16.10.4","xwiki-rendering-16.10.3","xwiki-rendering-16.10.2","xwiki-rendering-16.10.1","xwiki-rendering-16.10.0","xwiki-rendering-16.10.0-rc-1","xwiki-rendering-8.3-milestone-2","xwiki-rendering-8.3-milestone-1","xwiki-rendering-8.2-milestone-2","xwiki-rendering-8.2-milestone-1","xwiki-rendering-8.1-milestone-2","xwiki-rendering-8.1-milestone-1","xwiki-rendering-8.0-milestone-2","xwiki-rendering-8.0-milestone-1","xwiki-rendering-7.4-milestone-2","xwiki-rendering-7.4-milestone-1","xwiki-rendering-7.3-milestone-2"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-66474.json","vanir_signatures_modified":"2026-08-12T15:14:40Z","vanir_signatures":[{"deprecated":false,"digest":{"line_hashes":["84119038741461095662713590495830820630","128672261848722604921510459201043659783","182650674393567847885655176327441135883","315611649681667847417382014105960749093","134059787628542700764971198183293655248","72365698513867283538819363931311428972","18876696512412873585132228774107282220","171158128685606460603068519296795383979","255438115620241094020210796310644159943","244658762808244664803634046851625648003","220983014186452921869860611911738680696","84424962335358616442839744133050536297","44519015198532277550485794134668099614","195652711324386400503042102486982278888","44722140000460641049356549663144633865"],"threshold":0.9},"id":"CVE-2025-66474-1c32d1d8","signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-rendering/commit/9b71a2ee035815cfc29cebbfe81dbdd98f941d49","target":{"file":"xwiki-rendering-xml/src/main/java/org/xwiki/rendering/renderer/printer/XHTMLWikiPrinter.java"}},{"source":"https://github.com/xwiki/xwiki-platform/commit/12b780ccd5bca5fc8f74f46648d7e02fa04fbc11","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/test/java/com/xpn/xwiki/doc/XWikiDocumentTest.java"},"deprecated":false,"digest":{"line_hashes":["299178780818532377331656720264553975627","284260058324399509197709626461571675528","134211039581143240523418464500798060899","187313958933166175449081473277967602190","233285963910784360505550525086024271681","327526530745418328208228202597712597357","190951706038710664972665490367412004904","165931054052836900530860898252545598944"],"threshold":0.9},"id":"CVE-2025-66474-971175b7","signature_type":"Line","signature_version":"v1"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-rendering/commit/9b71a2ee035815cfc29cebbfe81dbdd98f941d49","target":{"file":"xwiki-rendering-xml/src/test/java/org/xwiki/rendering/renderer/printer/XHTMLWikiPrinterTest.java"},"deprecated":false,"digest":{"line_hashes":["24813110868214522558684577686847400591","142498559858103634313736697021927951506","134057656862043865469281232032709302290","69467088401702180907478577090679016654","28896370831207797683746459693749445843","269281691815835161522432341953586655972","15889274468392677476402592131513192297"],"threshold":0.9},"id":"CVE-2025-66474-a5085c1a"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/12b780ccd5bca5fc8f74f46648d7e02fa04fbc11","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/doc/XWikiDocument.java"},"deprecated":false,"digest":{"line_hashes":["112869021091346575375505237750693028250","144478665619945462576508936326038132723","93821440402805520692709100358192121346","212015895444939739720275999486235291310","234189203905745573204306996452948209449","16644979819060321983163501063878370339","312528747912372513056587486930602659437","250547587152822200714195024879914912794","275017574813785982292708049169017031998","86438348880216850575500662867784250859","221827598197298641269246146514129747544","274370694170792945359026863729688252453","75380792763609823722040128959496226088"],"threshold":0.9},"id":"CVE-2025-66474-ab48cd4f"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-rendering/commit/9b71a2ee035815cfc29cebbfe81dbdd98f941d49","target":{"file":"xwiki-rendering-xml/src/main/java/org/xwiki/rendering/renderer/printer/XHTMLWikiPrinter.java","function":"printRaw"},"deprecated":false,"digest":{"function_hash":"309782339902751005744151019807113797915","length":491},"id":"CVE-2025-66474-b9ad5f7b"},{"deprecated":false,"digest":{"function_hash":"305494018584097425232447318941524915322","length":3478},"id":"CVE-2025-66474-e7ea1bab","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/12b780ccd5bca5fc8f74f46648d7e02fa04fbc11","target":{"function":"display","file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/doc/XWikiDocument.java"}},{"target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/test/java/com/xpn/xwiki/doc/XWikiDocumentTest.java","function":"displayEscapesClosingHTMLMacro"},"deprecated":false,"digest":{"function_hash":"254830529269191140118168804831361989564","length":1044},"id":"CVE-2025-66474-fafe6b04","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/12b780ccd5bca5fc8f74f46648d7e02fa04fbc11"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}]}