CVE-2025-66474: Improper Neutralization of Directives in Dynamically Evaluated Code

🗓️ 10 Dec 2025 00:00:00Reported by Rapid7Type

{{/html}} injection in XWiki Rendering 16.10.9 and below allows user-led RCE.

Reporter	Title	Published	Views	Family All 11
BDU FSTEC	The vulnerability of the XWiki platform, which relates to the failure to implement measures to neutralize instructions in dynamically executed code, allows attackers to execute arbitrary code and gain access to read and modify data.	16 Dec 202500:00	–	bdu_fstec
CNNVD	XWiki Rendering 安全漏洞	10 Dec 202500:00	–	cnnvd
CVE	CVE-2025-66474	10 Dec 202521:59	–	cve
Cvelist	CVE-2025-66474 XWiki vulnerable to remote code execution through insufficient protection against {{/html}} injection	10 Dec 202521:59	–	cvelist
EUVD	EUVD-2025-202429	10 Dec 202521:59	–	euvd
Github Security Blog	XWiki vulnerable to remote code execution through insufficient protection against {{/html}} injection	10 Dec 202515:47	–	github
NVD	CVE-2025-66474	10 Dec 202522:16	–	nvd
OSV	GHSA-9XC6-C2RM-F27P XWiki vulnerable to remote code execution through insufficient protection against {{/html}} injection	10 Dec 202515:47	–	osv
Positive Technologies	PT-2025-50550	14 Jul 202500:00	–	ptsecurity
RedhatCVE	CVE-2025-66474	11 Dec 202522:01	–	redhatcve