ghsa-9xc6-c2rm-f27p
Vulnerability from github
Impact
Any user who can edit their own user profile or any other document can execute arbitrary script macros including Groovy and Python macros that allow remote code execution including unrestricted read and write access to all wiki contents. The reason is that rendering output is included as content of HTML macros with insufficient escaping, and it is thus possible to close the HTML macro and inject script macros that are executed with programming rights. To demonstrate, the content {{html}}{{/html {{/html}}}} can be inserted into any field of the user profile that supports wiki syntax like the "About" field. If this leads to the display of raw HTML, the instance is vulnerable.
Patches
This problem has been patched by extending the escaping introduced by XRENDERING-693 to also cover closing HTML macros that have spaces after the macro name in XWiki 16.10.10, 17.4.3 and 17.6.0RC1. A similar fix has been applied in org.xwiki.platform:xwiki-platform-oldcore as an extra safety net, see XWIKI-23378. At this point, we're not aware that this extra safety net would be required for security.
The patch also fixes the injection of opening HTML macro syntaxes, e.g., with {{html}}{{html{{/html}}}} which disrupts the rendering of the user profile but for which we haven't found any further security impact apart from the disruption of the UI.
Workarounds
We're not aware of any workarounds except for upgrading the affected module to a version with a fix.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.xwiki.rendering:xwiki-rendering-xml"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "16.10.10"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.xwiki.rendering:xwiki-rendering-xml"
},
"ranges": [
{
"events": [
{
"introduced": "17.0.0-rc-1"
},
{
"fixed": "17.4.3"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.xwiki.rendering:xwiki-rendering-xml"
},
"ranges": [
{
"events": [
{
"introduced": "17.5.0-rc-1"
},
{
"fixed": "17.6.0-rc-1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-66474"
],
"database_specific": {
"cwe_ids": [
"CWE-95"
],
"github_reviewed": true,
"github_reviewed_at": "2025-12-10T15:47:12Z",
"nvd_published_at": "2025-12-10T22:16:28Z",
"severity": "HIGH"
},
"details": "### Impact\nAny user who can edit their own user profile or any other document can execute arbitrary script macros including Groovy and Python macros that allow remote code execution including unrestricted read and write access to all wiki contents. The reason is that rendering output is included as content of HTML macros with insufficient escaping, and it is thus possible to close the HTML macro and inject script macros that are executed with programming rights. To demonstrate, the content `{{html}}{{/html {{/html}}}}` can be inserted into any field of the user profile that supports wiki syntax like the \"About\" field. If this leads to the display of raw HTML, the instance is vulnerable.\n\n### Patches\nThis problem has been patched by extending the escaping introduced by [XRENDERING-693](https://jira.xwiki.org/browse/XRENDERING-693) to also cover closing HTML macros that have spaces after the macro name in XWiki 16.10.10, 17.4.3 and 17.6.0RC1. A [similar fix](https://github.com/xwiki/xwiki-platform/commit/12b780ccd5bca5fc8f74f46648d7e02fa04fbc11) has been applied in `org.xwiki.platform:xwiki-platform-oldcore` as an extra safety net, see [XWIKI-23378](https://jira.xwiki.org/browse/XWIKI-23378). At this point, we\u0027re not aware that this extra safety net would be required for security.\n\nThe patch also fixes the injection of opening HTML macro syntaxes, e.g., with `{{html}}{{html{{/html}}}}` which disrupts the rendering of the user profile but for which we haven\u0027t found any further security impact apart from the disruption of the UI.\n\n### Workarounds\nWe\u0027re not aware of any workarounds except for upgrading the affected module to a version with a fix.",
"id": "GHSA-9xc6-c2rm-f27p",
"modified": "2025-12-11T15:48:01Z",
"published": "2025-12-10T15:47:12Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/xwiki/xwiki-rendering/security/advisories/GHSA-9xc6-c2rm-f27p"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66474"
},
{
"type": "WEB",
"url": "https://github.com/xwiki/xwiki-platform/commit/12b780ccd5bca5fc8f74f46648d7e02fa04fbc11"
},
{
"type": "WEB",
"url": "https://github.com/xwiki/xwiki-rendering/commit/9b71a2ee035815cfc29cebbfe81dbdd98f941d49"
},
{
"type": "PACKAGE",
"url": "https://github.com/xwiki/xwiki-rendering"
},
{
"type": "WEB",
"url": "https://jira.xwiki.org/browse/XRENDERING-693"
},
{
"type": "WEB",
"url": "https://jira.xwiki.org/browse/XRENDERING-792"
},
{
"type": "WEB",
"url": "https://jira.xwiki.org/browse/XRENDERING-793"
},
{
"type": "WEB",
"url": "https://jira.xwiki.org/browse/XWIKI-23378"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "XWiki vulnerable to remote code execution through insufficient protection against {{/html}} injection"
}
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.