High · published December 11, 2025
⚠️ An attacker can unleash their scripting sorcery with just a profile edit! That's right, an {{/html}} injection vulnerability in XWiki Rendering versions 16.10.9 and below, and 17.0.0-rc-1 through 17.5.0, can lead to Remote Code Execution (RCE). 🔥 Think of it like a restaurant where patrons can not only order but also add any ingredient they want to the menu. If a mischievous guest has access to the kitchen, they could throw in something toxic, wreaking havoc on unsuspecting diners – that’s what can happen here! With this vulnerability, an attacker could execute arbitrary scripts on the server, gaining unrestricted access to all wiki content. This means they could read, modify, or even delete crucial information, potentially leading to a total compromise of the system. The implications could be catastrophic for your data integrity!
Think of it like a restaurant where patrons can not only order but also add any ingredient they want to the menu. If a mischievous guest has access to the kitchen, they could throw in something toxic, wreaking havoc on unsuspecting diners – that’s what can happen here! This vulnerability arises from insufficient protection against {{/html}} injection, allowing users who can edit their own profile or documents to execute Groovy and Python macros. This leads to Remote Code Execution, where attackers can run any code they wish on the server.
With this vulnerability, an attacker could execute arbitrary scripts on the server, gaining unrestricted access to all wiki content. This means they could read, modify, or even delete crucial information, potentially leading to a total compromise of the system. The implications could be catastrophic for your data integrity! To protect your system, update XWiki to version 16.10.10, 17.4.3, or 17.6.0-rc-1 urgently. Also, consider reviewing user permissions to limit who can edit profiles and documents to minimize risk. Regular audits of your configurations can provide an extra layer of security! You've got this! Follow these steps, and you'll be locking down your wiki like a pro! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| xwiki/xwiki-rendering | < 16.10.10 | 16.10.10 |
| xwiki/xwiki-rendering | ≥ 17.0.0, < 17.4.3 | 17.4.3 |
| xwiki/xwiki-rendering | all versions | — |
| xwiki/xwiki-rendering | all versions | — |