CVE-2025-66474: XWiki vulnerable to remote code execution through insufficient protection against {{/html}} injection

CVE-2025-66474 · Severity: high · CVSS 8.8 · Published 2025-12-10

XWiki Rendering is a generic rendering system that converts textual input in a given syntax (wiki syntax, HTML, etc) into another syntax (XHTML, etc). Versions 16.10.9 and below, 17.0.0-rc-1 through 17.4.2 and 17.5.0-rc-1 through 17.5.0 have insufficient protection against {{/html}} injection, which attackers can exploit through RCE. Any user who can edit their own profile or any other document can execute arbitrary script macros, including Groovy and Python macros, which enable remote code execution as well as unrestricted read and write access to all wiki contents. This issue is fixed in versions 16.10.10, 17.4.3 and 17.6.0-rc-1.

Technologies: org.xwiki.rendering:xwiki-rendering-xml (Maven). Vendors: Maven.

Quick answers

Is CVE-2025-66474 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-66474 being exploited in the wild.
How severe is CVE-2025-66474?
High severity, with a CVSS score of 8.8, published 10 December 2025.
Which products and versions are affected?
org.xwiki.rendering:xwiki-rendering-xml (Maven) ECOSYSTEM:introduced=0,fixed=16.10.10.
Is there a fix for CVE-2025-66474?
Yes. org.xwiki.rendering:xwiki-rendering-xml (Maven): upgrade to 16.10.10 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
Am I affected by CVE-2025-66474?
Check whether you run org.xwiki.rendering:xwiki-rendering-xml (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.xwiki.rendering:xwiki-rendering-xml (Maven): upgrade to 16.10.10 or later
    # set org.xwiki.rendering:xwiki-rendering-xml to 16.10.10 in your pom.xml or build.gradle

Affected products

  • org.xwiki.rendering:xwiki-rendering-xml (Maven) ECOSYSTEM:introduced=0,fixed=16.10.10

Identifiers

  • CVE-2025-66474
  • GHSA-9xc6-c2rm-f27p

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.