CVE-2025-66474

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-66474", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2025-12-02T16:23:01.098Z", "datePublished": "2025-12-10T21:59:58.727Z", "dateUpdated": "2025-12-11T15:39:27.299Z"}, "containers": {"cna": {"title": "XWiki vulnerable to remote code execution through insufficient protection against {{/html}} injection", "problemTypes": [{"descriptions": [{"cweId": "CWE-95", "lang": "en", "description": "CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 8.7, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/xwiki/xwiki-rendering/security/advisories/GHSA-9xc6-c2rm-f27p", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/xwiki/xwiki-rendering/security/advisories/GHSA-9xc6-c2rm-f27p"}, {"name": "https://github.com/xwiki/xwiki-platform/commit/12b780ccd5bca5fc8f74f46648d7e02fa04fbc11", "tags": ["x_refsource_MISC"], "url": "https://github.com/xwiki/xwiki-platform/commit/12b780ccd5bca5fc8f74f46648d7e02fa04fbc11"}, {"name": "https://github.com/xwiki/xwiki-rendering/commit/9b71a2ee035815cfc29cebbfe81dbdd98f941d49", "tags": ["x_refsource_MISC"], "url": "https://github.com/xwiki/xwiki-rendering/commit/9b71a2ee035815cfc29cebbfe81dbdd98f941d49"}, {"name": "https://jira.xwiki.org/browse/XRENDERING-693", "tags": ["x_refsource_MISC"], "url": "https://jira.xwiki.org/browse/XRENDERING-693"}, {"name": "https://jira.xwiki.org/browse/XRENDERING-792", "tags": ["x_refsource_MISC"], "url": "https://jira.xwiki.org/browse/XRENDERING-792"}, {"name": "https://jira.xwiki.org/browse/XRENDERING-793", "tags": ["x_refsource_MISC"], "url": "https://jira.xwiki.org/browse/XRENDERING-793"}, {"name": "https://jira.xwiki.org/browse/XWIKI-23378", "tags": ["x_refsource_MISC"], "url": "https://jira.xwiki.org/browse/XWIKI-23378"}], "affected": [{"vendor": "xwiki", "product": "xwiki-rendering", "versions": [{"version": "< 16.10.10", "status": "affected"}, {"version": ">= 17.0.0-rc-1, < 17.4.3", "status": "affected"}, {"version": ">= 17.5.0-rc-1, < 17.6.0-rc-1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-12-10T21:59:58.727Z"}, "descriptions": [{"lang": "en", "value": "XWiki Rendering is a generic rendering system that converts textual input in a given syntax (wiki syntax, HTML, etc) into another syntax (XHTML, etc). Versions 16.10.9 and below, 17.0.0-rc-1 through 17.4.2 and 17.5.0-rc-1 through 17.5.0 have insufficient protection against {{/html}} injection, which attackers can exploit through RCE. Any user who can edit their own profile or any other document can execute arbitrary script macros, including Groovy and Python macros, which enable remote code execution as well as unrestricted read and write access to all wiki contents. This issue is fixed in versions 16.10.10, 17.4.3 and 17.6.0-rc-1."}], "source": {"advisory": "GHSA-9xc6-c2rm-f27p", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://jira.xwiki.org/browse/XRENDERING-793", "tags": ["exploit"]}, {"url": "https://jira.xwiki.org/browse/XRENDERING-792", "tags": ["exploit"]}, {"url": "https://jira.xwiki.org/browse/XRENDERING-693", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-12-11T15:39:13.257183Z", "id": "CVE-2025-66474", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-11T15:39:27.299Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-66474", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-12-11T15:39:13.257183Z"}}}], "references": [{"url": "https://jira.xwiki.org/browse/XRENDERING-793", "tags": ["exploit"]}, {"url": "https://jira.xwiki.org/browse/XRENDERING-792", "tags": ["exploit"]}, {"url": "https://jira.xwiki.org/browse/XRENDERING-693", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-11T15:39:24.768Z"}}], "cna": {"title": "XWiki vulnerable to remote code execution through insufficient protection against {{/html}} injection", "source": {"advisory": "GHSA-9xc6-c2rm-f27p", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 8.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}], "affected": [{"vendor": "xwiki", "product": "xwiki-rendering", "versions": [{"status": "affected", "version": "< 16.10.10"}, {"status": "affected", "version": ">= 17.0.0-rc-1, < 17.4.3"}, {"status": "affected", "version": ">= 17.5.0-rc-1, < 17.6.0-rc-1"}]}], "references": [{"url": "https://github.com/xwiki/xwiki-rendering/security/advisories/GHSA-9xc6-c2rm-f27p", "name": "https://github.com/xwiki/xwiki-rendering/security/advisories/GHSA-9xc6-c2rm-f27p", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/xwiki/xwiki-platform/commit/12b780ccd5bca5fc8f74f46648d7e02fa04fbc11", "name": "https://github.com/xwiki/xwiki-platform/commit/12b780ccd5bca5fc8f74f46648d7e02fa04fbc11", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/xwiki/xwiki-rendering/commit/9b71a2ee035815cfc29cebbfe81dbdd98f941d49", "name": "https://github.com/xwiki/xwiki-rendering/commit/9b71a2ee035815cfc29cebbfe81dbdd98f941d49", "tags": ["x_refsource_MISC"]}, {"url": "https://jira.xwiki.org/browse/XRENDERING-693", "name": "https://jira.xwiki.org/browse/XRENDERING-693", "tags": ["x_refsource_MISC"]}, {"url": "https://jira.xwiki.org/browse/XRENDERING-792", "name": "https://jira.xwiki.org/browse/XRENDERING-792", "tags": ["x_refsource_MISC"]}, {"url": "https://jira.xwiki.org/browse/XRENDERING-793", "name": "https://jira.xwiki.org/browse/XRENDERING-793", "tags": ["x_refsource_MISC"]}, {"url": "https://jira.xwiki.org/browse/XWIKI-23378", "name": "https://jira.xwiki.org/browse/XWIKI-23378", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "XWiki Rendering is a generic rendering system that converts textual input in a given syntax (wiki syntax, HTML, etc) into another syntax (XHTML, etc). Versions 16.10.9 and below, 17.0.0-rc-1 through 17.4.2 and 17.5.0-rc-1 through 17.5.0 have insufficient protection against {{/html}} injection, which attackers can exploit through RCE. Any user who can edit their own profile or any other document can execute arbitrary script macros, including Groovy and Python macros, which enable remote code execution as well as unrestricted read and write access to all wiki contents. This issue is fixed in versions 16.10.10, 17.4.3 and 17.6.0-rc-1."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-95", "description": "CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-12-10T21:59:58.727Z"}}}, "cveMetadata": {"cveId": "CVE-2025-66474", "state": "PUBLISHED", "dateUpdated": "2025-12-11T15:39:27.299Z", "dateReserved": "2025-12-02T16:23:01.098Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2025-12-10T21:59:58.727Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "xwiki-rendering", "vendor": "xwiki", "versions": [{"status": "affected", "version": "< 16.10.10"}, {"status": "affected", "version": ">= 17.0.0-rc-1, < 17.4.3"}, {"status": "affected", "version": ">= 17.5.0-rc-1, < 17.6.0-rc-1"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:xwiki:xwiki-rendering:*:*:*:*:*:*:*:*", "matchCriteriaId": "72CCDDF1-82EF-43BB-8A50-AB4FEBF86DB2", "versionEndExcluding": "16.10.10", "vulnerable": true}, {"criteria": "cpe:2.3:a:xwiki:xwiki-rendering:*:*:*:*:*:*:*:*", "matchCriteriaId": "BAFE697A-6548-4734-9BB9-1F9D5B39B6F6", "versionEndExcluding": "17.4.3", "versionStartIncluding": "17.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:xwiki:xwiki-rendering:17.5.0:-:*:*:*:*:*:*", "matchCriteriaId": "C6245F8B-C8B0-4818-A7BA-E2FA27E08C20", "vulnerable": true}, {"criteria": "cpe:2.3:a:xwiki:xwiki-rendering:17.5.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "6A81FD5E-9EDD-4A70-A3CF-81E0FADCD720", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "XWiki Rendering is a generic rendering system that converts textual input in a given syntax (wiki syntax, HTML, etc) into another syntax (XHTML, etc). Versions 16.10.9 and below, 17.0.0-rc-1 through 17.4.2 and 17.5.0-rc-1 through 17.5.0 have insufficient protection against {{/html}} injection, which attackers can exploit through RCE. Any user who can edit their own profile or any other document can execute arbitrary script macros, including Groovy and Python macros, which enable remote code execution as well as unrestricted read and write access to all wiki contents. This issue is fixed in versions 16.10.10, 17.4.3 and 17.6.0-rc-1."}, {"lang": "es", "value": "XWiki Rendering es un sistema de renderizado gen\u00e9rico que convierte la entrada textual en una sintaxis dada (sintaxis wiki, HTML, etc.) en otra sintaxis (XHTML, etc.). Las versiones 16.10.9 e inferiores, 17.0.0-rc-1 hasta 17.4.2 y 17.5.0-rc-1 hasta 17.5.0 tienen protecci\u00f3n insuficiente contra la inyecci\u00f3n de {{/html}}, que los atacantes pueden exploit a trav\u00e9s de RCE. Cualquier usuario que pueda editar su propio perfil o cualquier otro documento puede ejecutar macros de script arbitrarias, incluyendo macros Groovy y Python, que permiten la ejecuci\u00f3n remota de c\u00f3digo, as\u00ed como acceso de lectura y escritura sin restricciones a todos los contenidos wiki. Este problema est\u00e1 solucionado en las versiones 16.10.10, 17.4.3 y 17.6.0-rc-1."}], "id": "CVE-2025-66474", "lastModified": "2026-09-25T23:10:00.463", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-66474", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-12-11T15:39:13.257183Z", "version": "2.0.3"}}]}, "published": "2025-12-10T22:16:28.003", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/xwiki/xwiki-platform/commit/12b780ccd5bca5fc8f74f46648d7e02fa04fbc11"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/xwiki/xwiki-rendering/commit/9b71a2ee035815cfc29cebbfe81dbdd98f941d49"}, {"source": "security-advisories@github.com", "tags": ["Patch", "Vendor Advisory"], "url": "https://github.com/xwiki/xwiki-rendering/security/advisories/GHSA-9xc6-c2rm-f27p"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Patch", "Vendor Advisory"], "url": "https://jira.xwiki.org/browse/XRENDERING-693"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Patch", "Vendor Advisory"], "url": "https://jira.xwiki.org/browse/XRENDERING-792"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Patch", "Vendor Advisory"], "url": "https://jira.xwiki.org/browse/XRENDERING-793"}, {"source": "security-advisories@github.com", "tags": ["Patch", "Vendor Advisory"], "url": "https://jira.xwiki.org/browse/XWIKI-23378"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Patch", "Vendor Advisory"], "url": "https://jira.xwiki.org/browse/XRENDERING-693"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Patch", "Vendor Advisory"], "url": "https://jira.xwiki.org/browse/XRENDERING-792"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Patch", "Vendor Advisory"], "url": "https://jira.xwiki.org/browse/XRENDERING-793"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-95"}], "source": "security-advisories@github.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-94"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{"created": "2025-12-11T15:16:11.097945+00:00", "updated": "2025-12-11T15:16:11.098054+00:00", "vendors": ["xwiki", "xwiki$PRODUCT$rendering"]}