XWiki Platform CVE-2025-66472

Exploitation requires the attacker to deliver a crafted URL (via the xredirect parameter of the delete-confirmation / DeleteApplication flow) to a victim and have that victim interact - specifically click the 'No' button on the deletion confirmation message (UI:P). No attacker authentication is needed (PR:N), but meaningful impact is gated on the VICTIM'S privilege level: the advisory's arbitrary-action/RCE outcome applies only when the clicking victim holds admin or programming rights. It affects default template code in XWiki Platform Flamingo Skin Resources and Web Templates versions >= 6.2-milestone-1 and < 16.10.10, and 17.0.0-rc-1 through < 17.4.2; instances on 16.10.10, 17.4.2, or 17.5.0+ (or with the manual template patch and restart applied) are not vulnerable.

This is a reflected XSS (CWE-79) in XWiki Platform's Flamingo Skin Resources and Web Templates, triggered via the xredirect parameter in the delete-confirmation flow. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P) scores 6.5 and is internally consistent: network-reachable, low-complexity, unauthenticated attacker, but requiring victim interaction (clicking the 'No' button) - hence the moderate rather than critical rating. Note the 4.0 vector encodes impact as subsequent-system (SC:H/SI:H/SA:H) with vulnerable-system VC/VI/VA:N, reflecting that the script executes in the victim's browser/session rather than directly against the XWiki server. EPSS is modest at 0.51% (41st percentile), indicating no strong signal of mass exploitation, and there is no CISA KEV listing. However, publicly available exploit material exists (the XWiki JIRA issue XWIKI-23244 is tagged as an exploit reference) and a detailed GHSA advisory plus commit-level source evidence are public, lowering the bar to weaponization. The critical amplifier is context-dependent: per the GHSA, if the victim holds admin or programming rights, the reflected script can perform arbitrary privileged actions up to remote code execution on the installation. So real-world priority is moderate-to-high for XWiki operators - the raw 6.5 understates worst-case impact against privileged victims, while the UI:P requirement and low EPSS keep it below drop-everything urgency. This is a genuine issue to patch, not merely a high-number-low-risk artifact, but exploitation realistically depends on social-engineering a privileged user.

An attacker crafts a URL to a target XWiki instance's delete-confirmation page with a malicious payload injected via the xredirect parameter and lures an authenticated admin/programming-right user to open it (phishing link). When the victim clicks the 'No' button on the confirmation dialog, the attacker-supplied script executes in their session, enabling privileged actions up to remote code execution. Public exploit/reproduction detail exists via the XWiki JIRA issue (XWIKI-23244) and the GHSA advisory, so reproduction is straightforward.