Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2025-66474

28
FAUCET Score

CVE-2025-66474 is a critical vulnerability affecting XWiki Rendering versions 16.10.9 and below, 17.0.0-rc-1 through 17.4.2, and 17.5.0-rc-1 through 17.5.0. It allows authenticated users with editing privileges to achieve Remote Code Execution (RCE) due to insufficient protection against {{/html}} injection. With a CVSS score of 8.8 (High), this vulnerability has a low attack complexity and can lead to full compromise of the wiki, including unrestricted read/write access and arbitrary script execution. While no public exploits or active exploitation have been observed, and community discussion is minimal, organizations should prioritize patching to versions 16.10.10, 17.4.3, or 17.6.0-rc-1 to mitigate this significant risk.

Impacted Technologies

VendorProductVersion(s)CPE
< 16.10.10CPE matchmatch criteria
cpe:2.3:a:xwiki:xwiki-rendering:*:*:*:*:*:*:*:*
>= 17.0.0, < 17.4.3CPE matchmatch criteria
cpe:2.3:a:xwiki:xwiki-rendering:*:*:*:*:*:*:*:*
17.5.0CPE matchmatch criteria
cpe:2.3:a:xwiki:xwiki-rendering:17.5.0:-:*:*:*:*:*:*
17.5.0CPE matchmatch criteria
cpe:2.3:a:xwiki:xwiki-rendering:17.5.0:rc1:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 4.0

8.7HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector
NETWORK
Attack Complexity
LOW
Attack Requirements
NONE
Privileges Required
LOW
User Interaction
NONE
VS Confidentiality
HIGH
VS Integrity
HIGH
VS Availability
HIGH
SS Confidentiality
NONE
SS Integrity
NONE
SS Availability
NONE
Exploit Maturity
NOT_DEFINED
CvssVersion
4.0

Exploit Intelligence

EPSS Score
0.89%
Probability of exploitation in next 30 days
EPSS Percentile
55.8%
Percentile rank of EPSS score among Peer Group
As of 2026-07-28
Model: v2026.06.15
This CVE's current EPSS score of 0.0089 is in the 51st percentile among its peer group of 17,844 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.3 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (4)

github_advisorypatch availablevia nvd_reference
View patch
mavenpatch availablevia ghsa
Product: org.xwiki.rendering:xwiki-rendering-xmlFixed in: 16.10.10
mavenpatch availablevia ghsa
Product: org.xwiki.rendering:xwiki-rendering-xmlFixed in: 17.4.3
mavenpatch availablevia ghsa
Product: org.xwiki.rendering:xwiki-rendering-xmlFixed in: 17.6.0-rc-1

Vendor Advisories (1)

mavenGHSA-9xc6-c2rm-f27phigh

XWiki vulnerable to remote code execution through insufficient protection against {{/html}} injection

Dec 10, 2025

References

github.com / xwiki/xwiki-platform/commit/12b780ccd5bca5fc8f74f46648d7e02fa04fbc11
Patch
github.com / xwiki/xwiki-rendering/commit/9b71a2ee035815cfc29cebbfe81dbdd98f941d49
Patch
github.com / xwiki/xwiki-rendering/security/advisories/GHSA-9xc6-c2rm-f27p
PatchVendor Advisory
jira.xwiki.org / browse/XRENDERING-693
ExploitPatchVendor Advisory
jira.xwiki.org / browse/XRENDERING-792
ExploitPatchVendor Advisory
jira.xwiki.org / browse/XRENDERING-793
ExploitPatchVendor Advisory
jira.xwiki.org / browse/XWIKI-23378
PatchVendor Advisory