CVE-2025-66474
Published: 10 December 2025
Summary
CVE-2025-66474 is a high-severity Eval Injection (CWE-95) vulnerability in Xwiki Xwiki-Rendering. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 29.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Timely flaw remediation through patching directly fixes the insufficient {{/html}} injection protection in XWiki Rendering, preventing RCE via script macros.
Information input validation neutralizes malicious wiki syntax and HTML inputs, blocking injection of executable Groovy and Python macros during rendering.
Least privilege restricts document and profile edit permissions to essential users only, limiting the attack surface for low-privileged authenticated exploitation.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is an HTML injection in a public-facing web application (XWiki Rendering) exploitable by low-privileged authenticated users (T1190), leading to arbitrary macro/script execution (Groovy/Python) for server RCE, enabling privilege escalation (T1068).
NVD Description
XWiki Rendering is a generic rendering system that converts textual input in a given syntax (wiki syntax, HTML, etc) into another syntax (XHTML, etc). Versions 16.10.9 and below, 17.0.0-rc-1 through 17.4.2 and 17.5.0-rc-1 through 17.5.0 have insufficient protection against {{/html}}…
more
injection, which attackers can exploit through RCE. Any user who can edit their own profile or any other document can execute arbitrary script macros, including Groovy and Python macros, which enable remote code execution as well as unrestricted read and write access to all wiki contents. This issue is fixed in versions 16.10.10, 17.4.3 and 17.6.0-rc-1.
Deeper analysisAI
CVE-2025-66474 is an insufficient protection against {{/html}} injection vulnerability in XWiki Rendering, a generic rendering system that converts textual input from syntaxes like wiki syntax or HTML into formats such as XHTML. The flaw affects XWiki Rendering versions 16.10.9 and below, 17.0.0-rc-1 through 17.4.2, and 17.5.0-rc-1 through 17.5.0. It is rated with a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and maps to CWE-95 (Improper Neutralization of Directives in Dynamically Evaluated Code) and CWE-94 (Improper Control of Generation of Code).
Any authenticated user with permission to edit their own profile or any other document can exploit this vulnerability over the network with low complexity. Successful exploitation allows execution of arbitrary script macros, such as Groovy and Python, leading to remote code execution on the server as well as unrestricted read and write access to all wiki contents.
The issue is fixed in XWiki Rendering versions 16.10.10, 17.4.3, and 17.6.0-rc-1, as detailed in the project's GitHub commits, security advisory (GHSA-9xc6-c2rm-f27p), and Jira tickets XRENDERING-693 and XRENDERING-792. Security practitioners should prioritize upgrading affected instances to patched versions to mitigate the risk of RCE.
Details
- CWE(s)