CVE-2025-66474: 
Java vulnerability analysis and mitigation

CVE-2025-66474 is a remote code execution vulnerability in the XWiki rendering engine caused by insufficient escaping of {{/html}} macro syntax in XHTML rendering output. Any authenticated user with document editing privileges — including editing their own user profile — can inject arbitrary script macros (Groovy, Python, etc.) that execute with full programming rights. The vulnerability affects org.xwiki.rendering:xwiki-rendering-xml versions prior to 16.10.10, versions 17.0.0-rc-1 through 17.4.3, and versions 17.5.0-rc-1 through 17.6.0-rc-1. It was published on December 10, 2025, with a CVSS v3.1 score of 8.8 (High) and a CVSS v4.0 score of 8.7 (High) (Github Advisory, XWiki Security Advisory).

The root cause is classified as CWE-94 (Code Injection) and CWE-95 (Eval Injection). When the XWiki XHTML renderer wraps field output inside an {{html}} macro, it previously failed to escape closing HTML macro syntax variants that include a space before the closing braces (e.g., {{/html }}). An attacker can insert content such as {{html}}{{/html {{/html}}}} into any wiki-syntax-enabled field (e.g., the user profile "About" field), which causes the renderer to prematurely close the wrapping HTML macro and inject subsequent script macros that are evaluated with programming rights. The fix, tracked as XRENDERING-792 and XRENDERING-793, extended the escaping logic in XHTMLWikiPrinter.java to cover all variants of both opening and closing HTML macro syntax strings, and a complementary safety-net fix was applied to XWikiDocument.java in the platform (XWIKI-23378) (XWiki Security Advisory, Rendering Commit, Platform Commit).

Successful exploitation grants the attacker full programming rights within the XWiki instance, enabling unrestricted read and write access to all wiki content. This allows data theft, unauthorized modification or deletion of wiki pages, execution of arbitrary Groovy or Python code on the server, and potential lateral movement within the network. The confidentiality, integrity, and availability of the entire wiki platform are all fully compromised by a low-privileged user without requiring any interaction from other users (Github Advisory, XWiki Security Advisory).

Proof-of-concept exploit details are publicly documented in the XWiki Jira issue tracker (XRENDERING-792, XRENDERING-793, XRENDERING-693), and the advisory itself includes a working demonstration payload (XWiki Security Advisory). As of the time of disclosure, there is no evidence of active in-the-wild exploitation. The EPSS score is approximately 0.53–0.678% (72nd percentile), indicating a moderate relative probability of exploitation within 30 days (Github Advisory). The vulnerability is not listed in the CISA KEV catalog, and no specific threat actor attribution has been reported.

1. Reconnaissance: Identify an XWiki instance running a vulnerable version of xwiki-rendering-xml (< 16.10.10, or 17.0.0-rc-1 to < 17.4.3, or 17.5.0-rc-1 to < 17.6.0-rc-1). Confirm vulnerability by checking if inserting {{html}}{{/html {{/html}}}} into a wiki-syntax field results in raw HTML being displayed.
2. Authenticate: Log in to the XWiki instance with any low-privilege user account that has document editing rights (e.g., a self-registered account).
3. Navigate to an editable field: Go to the user profile edit page and locate a field that supports wiki syntax, such as the "About" field.
4. Inject the payload: Insert a crafted payload that closes the wrapping HTML macro and injects a script macro, for example:

   {{html}}{{/html {{groovy}}Runtime.getRuntime().exec("id"){{/groovy}}{{/html}}

   The space in {{/html bypasses the original escaping logic, prematurely closing the HTML macro context.
5. Trigger rendering: Save the profile and navigate to the page that renders the field. The injected Groovy (or Python) macro executes server-side with full programming rights.
6. Achieve objectives: Use the code execution capability to read/write wiki content, exfiltrate data, establish persistence, or pivot to other systems (XWiki Security Advisory, Github Advisory).

• Logs: XWiki access logs showing POST requests to user profile edit endpoints (e.g., /xwiki/bin/save/XWiki/<username>) containing wiki macro syntax such as {{/html, {{groovy, or {{python in request body parameters.
• Logs: Server-side rendering logs or error logs showing unexpected Groovy/Python macro execution events triggered from user profile or document fields.
• File System: Unexpected files created by the XWiki process (e.g., web shells, scripts) in the XWiki data or temp directories, potentially written via Groovy File API calls.
• Network: Unusual outbound connections from the XWiki server process to external IPs, potentially indicating reverse shell or data exfiltration activity initiated by injected code.
• Process: Unexpected child processes spawned by the XWiki JVM process (e.g., bash, sh, curl, wget, python) on the host operating system.

Upgrade org.xwiki.rendering:xwiki-rendering-xml to one of the patched versions: 16.10.10, 17.4.3, or 17.6.0-rc-1. The fix extends HTML macro syntax escaping in the XHTML renderer to cover all variants of opening and closing macro syntax, including those with spaces. A complementary safety-net fix is included in org.xwiki.platform:xwiki-platform-oldcore (XWIKI-23378). The XWiki team is not aware of any configuration-based workarounds — upgrading is the only remediation (XWiki Security Advisory, Github Advisory).