CVE-2025-55728

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-55728
XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence. Starting in version 1.0 and prior to version 1.26.5, missing escaping of the classes parameter in the panel macro allows remote code execution for any user who can edit any page The classes parameter is used without escaping in XWiki syntax, thus allowing XWiki syntax injection which enables remote code execution. Version 1.26.5 contains a patch for the issue.

10.0 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References
Link Resource
https://github.com/xwikisas/xwiki-pro-macros/blob/93ac1a38c829e3ef787379b2b45eb043a573e5f7/xwiki-pro-macros-ui/src/main/resources/XWiki/Macros/Panel.xml#L554 Product
https://github.com/xwikisas/xwiki-pro-macros/commit/3ca815294bf54fc024b2363efbece7aa08b8efd5 Patch
https://github.com/xwikisas/xwiki-pro-macros/security/advisories/GHSA-48f4-h726-74p5 Vendor Advisory
https://jira.xwiki.org/browse/XWIKI-20449 Not Applicable
https://github.com/xwikisas/xwiki-pro-macros/security/advisories/GHSA-48f4-h726-74p5 Vendor Advisory
https://jira.xwiki.org/browse/XWIKI-20449 Not Applicable
Configurations

Configuration 1 (hide)

cpe:2.3:a:xwiki:pro_macros:*:*:*:*:*:*:*:*
History

17 Sep 2025, 19:45

Type Values Removed Values Added
First Time Xwiki
Xwiki pro Macros
References () https://github.com/xwikisas/xwiki-pro-macros/blob/93ac1a38c829e3ef787379b2b45eb043a573e5f7/xwiki-pro-macros-ui/src/main/resources/XWiki/Macros/Panel.xml#L554 - () https://github.com/xwikisas/xwiki-pro-macros/blob/93ac1a38c829e3ef787379b2b45eb043a573e5f7/xwiki-pro-macros-ui/src/main/resources/XWiki/Macros/Panel.xml#L554 - Product
References () https://github.com/xwikisas/xwiki-pro-macros/commit/3ca815294bf54fc024b2363efbece7aa08b8efd5 - () https://github.com/xwikisas/xwiki-pro-macros/commit/3ca815294bf54fc024b2363efbece7aa08b8efd5 - Patch
References () https://github.com/xwikisas/xwiki-pro-macros/security/advisories/GHSA-48f4-h726-74p5 - () https://github.com/xwikisas/xwiki-pro-macros/security/advisories/GHSA-48f4-h726-74p5 - Vendor Advisory
References () https://jira.xwiki.org/browse/XWIKI-20449 - () https://jira.xwiki.org/browse/XWIKI-20449 - Not Applicable
CWE CWE-94
CPE cpe:2.3:a:xwiki:pro_macros:*:*:*:*:*:*:*:*

11 Sep 2025, 14:15

Type Values Removed Values Added
References () https://github.com/xwikisas/xwiki-pro-macros/security/advisories/GHSA-48f4-h726-74p5 - () https://github.com/xwikisas/xwiki-pro-macros/security/advisories/GHSA-48f4-h726-74p5 -
References () https://jira.xwiki.org/browse/XWIKI-20449 - () https://jira.xwiki.org/browse/XWIKI-20449 -

09 Sep 2025, 19:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-09-09 19:15

Updated : 2025-09-17 19:45

NVD link : CVE-2025-55728

Mitre link : CVE-2025-55728

CVE.ORG link : CVE-2025-55728

JSON object : View

Products Affected

xwiki

  • pro_macros
CWE
CWE-95

Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')

CWE-94

Improper Control of Generation of Code ('Code Injection')