CVE Feed

    Dashboard / CVE / CVE-2025-66474

    CVE-2025-66474

    XWiki Rendering is a generic rendering system that converts textual input in a given syntax (wiki syntax, HTML, etc) into another syntax (XHTML, etc). Versions 16.10.9 and below, 17.0.0-rc-1 through 17.4.2 and 17.5.0-rc-1 through 17.5.0 have insufficient protection against {{/html}} injection, which attackers can exploit through RCE. Any user who can edit their own profile or any other document can execute arbitrary script macros, including Groovy and Python macros, which enable remote code execution as well as unrestricted read and write access to all wiki contents. This issue is fixed in versions 16.10.10, 17.4.3 and 17.6.0-rc-1.

    Published:Dec 10, 2025
    Last Modified:Dec 19, 2025
    EPS:Dec 10, 2025
    EPSS Score:0.00391
    CVSS Score:8.8

    Affected Products

    Vendor
    Xwiki
    Product
    Rendering
    Vendor
    Xwiki
    Product
    Xwiki-rendering

    Exploits

    https://jira.xwiki.org/browse/XRENDERING-693https://jira.xwiki.org/browse/XRENDERING-792https://jira.xwiki.org/browse/XRENDERING-793https://jira.xwiki.org/browse/XRENDERING-693https://jira.xwiki.org/browse/XRENDERING-792https://jira.xwiki.org/browse/XRENDERING-793

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High