Xwiki Pro Macros vulnerabilities

🔔 Create alert RSS Version checker

Published CVEs affecting Xwiki Pro Macros: 2 record(s), with affected versions and fixes.
cpe:2.3:a:xwiki:pro_macros

CVE-2025-65036 High · 8.3 CWE-862 Dec 5, 2025

XWiki Remote Macros vulnerable to remote code execution using the confluence details summary macro

XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence. Prior to 1.27.1, the macro executes Velocity from the details pages without checking for permissions, which can lead to remote code execution. This vulnerability is fixed in 1.27.1.

CVE-2025-65089 Medium · 6.5 CWE-862 Nov 19, 2025

XWiki view file macro: User can view content of office file without view rights on the attachment

XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence. Prior to version 1.27.0, a user with no view rights on a page may see the content of an office attachment displayed with the view file macro. This issue has been patched in version 1.27.0.