PT-2025-50550 · Xwiki · Xwiki

Highmichitux · Published 2025-07-14 · Updated 2025-12-19 · CVE-2025-66474

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions XWiki versions 16.10.9 and below, 17.0.0-rc-1 through 17.4.2, and 17.5.0-rc-1 through 17.5.0

Description The XWiki Rendering system lacks sufficient protection against {{/html}} injection. This allows attackers to achieve remote code execution (RCE). Any user with the ability to edit their profile or other documents can execute arbitrary script macros, including Groovy and Python macros. This enables unrestricted read and write access to all wiki content.

Recommendations Update to XWiki version 16.10.10 or later. Update to XWiki version 17.4.3 or later. Update to XWiki version 17.6.0-rc-1 or later.

Exploit

Fix

RCE

Code Injection

Eval Injection

Weakness Enumeration

CWE-94

CWE-95

Related Identifiers

BDU:2025-15982

CVE-2025-66474

GHSA-9XC6-C2RM-F27P

Affected Products

Xwiki

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66474.json · Exploit
• 🔥 https://jira.xwiki.org/browse/XRENDERING-793 · Exploit
• 🔥 https://jira.xwiki.org/browse/XRENDERING-792 · Exploit
• 🔥 https://jira.xwiki.org/browse/XRENDERING-693 · Exploit
• https://github.com/xwiki/xwiki-platform/commit/12b780ccd5bca5fc8f74f46648d7e02fa04fbc11 · Patch
• https://github.com/xwiki/xwiki-rendering/security/advisories/GHSA-9xc6-c2rm-f27p · Vendor Advisory
• https://github.com/xwiki/xwiki-rendering/commit/9b71a2ee035815cfc29cebbfe81dbdd98f941d49 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-66474 · Security Note
• https://jira.xwiki.org/browse/XWIKI-23378 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-66474 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-15982 · Security Note
• https://t.me/cveNotify/146358 · Telegram Post
• https://twitter.com/CVEnew/status/1999108905247613021 · Twitter Post
• https://t.me/CVEtracker/39416 · Telegram Post