PT-2025-36918 · Xwiki · Xwiki Remote Macros

Farcasut · Published 2025-09-09 · Updated 2025-09-17 · CVE-2025-55728

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: XWiki Remote Macros versions 1.0 through 1.26.5

Description: XWiki Remote Macros provides XWiki rendering macros used for content migration from Confluence. A lack of escaping for the classes parameter within the panel macro allows for remote code execution. This affects any user with page editing permissions, as the classes parameter is used without proper escaping in XWiki syntax, enabling XWiki syntax injection.

Recommendations: Update to version 1.26.5 or later.

Exploit

Fix

RCE

Code Injection

Eval Injection

Weakness Enumeration

CWE-94

CWE-95

Related Identifiers

CVE-2025-55728

GHSA-48F4-H726-74P5

Affected Products

Xwiki Remote Macros

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/55xxx/CVE-2025-55728.json · Exploit
• 🔥 https://github.com/xwikisas/xwiki-pro-macros/security/advisories/GHSA-48f4-h726-74p5 · Exploit
• 🔥 https://jira.xwiki.org/browse/XWIKI-20449 · Exploit
• https://github.com/xwikisas/xwiki-pro-macros/commit/3ca815294bf54fc024b2363efbece7aa08b8efd5 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-55728 · Security Note
• https://osv.dev/vulnerability/CVE-2025-55728 · Vendor Advisory
• https://github.com/xwikisas/xwiki-pro-macros/blob/93ac1a38c829e3ef787379b2b45eb043a573e5f7/xwiki-pro-macros-ui/src/main/resources/XWiki/Macros/Panel.xml#L554 · Note
• https://twitter.com/CCBalert/status/1965791864541364575 · Twitter Post
• https://twitter.com/CVEnew/status/1965509628319727893 · Twitter Post
• https://t.me/cveNotify/135706 · Telegram Post