VulnSocial

CVE-2025-66474Disclosure(xwiki / xwiki-rendering)

LOWCVSS 8.8 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

XWiki Rendering is a generic rendering system that converts textual input in a given syntax (wiki syntax, HTML, etc) into another syntax (XHTML, etc). Versions 16.10.9 and below, 17.0.0-rc-1 through 17.4.2 and 17.5.0-rc-1 through 17.5.0 have insufficient protection against {{/html}} injection, which attackers can exploit through RCE. Any user who can edit their own profile or any other document can execute arbitrary script macros, including Groovy and Python macros, which enable remote code execution as well as unrestricted read and write access to all wiki contents. This issue is fixed in versions 16.10.10, 17.4.3 and 17.6.0-rc-1.

xwiki CVEsBack to dashboard
0.0/ 10 priority

Sources & remediation

Patch / fix
Exploit / PoC references
Weakness type (CWE)
CWE-95CWE-94

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • xwiki-rendering

Threat summary

  • 1 mentions across 1 observed day

What's happening

  • Technical details provided in 1 signal
  • Disclosure: 1 classified signal
  • 1 total mentions across 1 day

Affected systems

Vendors
xwiki
Products
xwiki-rendering

1 version affected across 1 product

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-09-18: 1Technical Details · 2026-09-18: 109-18
Signal classification1 categories
Disclosure
1100.0%
Referenced assets1 URL
Full discourse1 post
  • DailyCVE@dailycve
    Disclosure

    🔴 XWiki Platform, Remote Code Execution via Insufficient Escaping of #HTML Macro Rendering Output, #CVE-2025-66474 (Critical) -DC-Sep2026-2475 https://dailycve.com/xwiki-platform-remote-code-execution-via-insufficient-escaping-of-html-macro-rendering-output-cve-2025-66474-critical-dc-sep2026-2475/

    Post summary

    The tweet discloses a newly identified critical Remote Code Execution vulnerability (CVE‑2025‑66474) in the XWiki platform caused by insufficient escaping of HTML macro output, pointing to a detailed advisory page.

    0000042
    237 followersView on X
CPE platform detail3 entries

3 of 3 entries

PartVendorProductVersionTarget SWTarget HW
Appxwikixwiki-rendering---
Appxwikixwiki-rendering17.5.0--
Appxwikixwiki-rendering17.5.0--

Explore more

Back to dashboardxwiki CVEsxwiki-rendering vulnerabilities