XWiki Remote Macros vulnerable to remote code execution using the panel macro (xwikisas xwiki-pro-macros)

CVE-2025-55728

CRITICAL 10.0

En bref

Source: NVD
EPSS: EPSS 0.79 % · centile 56 (2026-10-31)
État: PUBLISHED
Publiée: 2025-09-09 18:40 UTC
Mise à jour: 2025-09-11 13:15 UTC
Attribuée par: GitHub_M
Statut NVD: Analyzed

Rechercher sur…

Description

XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence. Starting in version 1.0 and prior to version 1.26.5, missing escaping of the classes parameter in the panel macro allows remote code execution for any user who can edit any page The classes parameter is used without escaping in XWiki syntax, thus allowing XWiki syntax injection which enables remote code execution. Version 1.26.5 contains a patch for the issue.

Faiblesses (CWE)

CWE-95 — Injection via eval
CWE-94 — Injection de code

Références

Scores

Version	Score	Vecteur	Évalué par
CVSS 3.1	CRITICAL 10.0	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H	GitHub_M
CVSS 3.1	CRITICAL 10.0	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H	NVD · security-advisories@github.com (Secondary)
CVSS 3.1	CRITICAL 9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	NVD · nvd@nist.gov (Primary)

Références européennes

ENISA EUVD · EUVD-2025-27451
GCVE · GCVE-0-2025-55728

Configurations affectées (CPE NVD)

cpe:2.3:a:xwiki:pro_macros:*:*:*:*:*:*:*:* ≥ 1.0 < 1.26.5

Produits affectés

Produit	Versions
xwikisas · xwiki-pro-macros	affected >= 1.0, < 1.26.5

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD

💣 XWiki Remote Macros vulnerable to remote code execution using the panel macro (xwikisas xwiki-pro-macros)