PT-2025-10097 · Xwiki · Xwiki Confluence Migrator Pro

Trrenty · Published 2025-03-07 · Updated 2025-03-08 · CVE-2025-27603

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions XWiki Confluence Migrator Pro versions prior to 1.2.0

Description A user without programming rights can execute arbitrary code due to an unescaped translation when creating a page using the Migration Page template. This issue allows for the execution of arbitrary code, potentially leading to security breaches. The estimated number of affected devices and real-world incidents are not specified.

Recommendations For versions prior to 1.2.0, update to version 1.2.0 to fix the issue. As a temporary workaround, consider restricting access to the Migration Page template until the update is applied. Additionally, avoid using the XWiki.TranslationDocumentClass object with scope USER in the object editor to minimize the risk of exploitation.

Exploit

Fix

Eval Injection

Weakness Enumeration

CWE-95

Related Identifiers

BDU:2025-10719

CVE-2025-27603

GHSA-6QVP-39MM-95V8

Affected Products

Xwiki Confluence Migrator Pro

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/27xxx/CVE-2025-27603.json · Exploit
• 🔥 https://github.com/xwikisas/application-confluence-migrator-pro/security/advisories/GHSA-6qvp-39mm-95v8 · Exploit
• https://osv.dev/vulnerability/CVE-2025-27603 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-10719 · Security Note
• https://osv.dev/vulnerability/GHSA-6qvp-39mm-95v8 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-27603 · Security Note
• https://github.com/xwikisas/application-confluence-migrator-pro/commit/36cef2271bd429773698ca3a21e47b6d51d6377d · Note
• https://github.com/xwikisas/application-confluence-migrator-pro · Note
• https://t.me/cvetracker/18683 · Telegram Post
• https://twitter.com/CVEnew/status/1898246363445359083 · Twitter Post
• https://twitter.com/CveFindCom/status/1898048962960990536 · Twitter Post
• https://t.me/latest_high_impact_cve/1935 · Telegram Post
• https://t.me/cvedetector/19829 · Telegram Post
• https://t.me/cvenotify/113855 · Telegram Post