PT-2025-36930 · Xwiki · Xwiki Remote Macros

Farcasut · Published 2025-09-09 · Updated 2025-09-10 · CVE-2025-55730

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: XWiki Remote Macros versions 1.0 through 1.26.5

Description: XWiki Remote Macros provides XWiki rendering macros used for migrating content from Confluence. A missing escaping mechanism in the confluence paste code macro allows for remote code execution for users with page editing permissions. The classes parameter is used without proper escaping, leading to XWiki syntax injection, which can enable remote code execution.

Recommendations: Update to version 1.26.5 or later.

Exploit

Fix

Improper Encoding or Escaping of Output

Weakness Enumeration

CWE-116

Related Identifiers

CVE-2025-55730

GHSA-5W8V-H22G-J2MP

Affected Products

Xwiki Remote Macros

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/55xxx/CVE-2025-55730.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-55730 · Security Note
• https://osv.dev/vulnerability/CVE-2025-55730 · Vendor Advisory
• https://github.com/xwikisas/xwiki-pro-macros/commit/049716df415aaf00938a91d618d382777820d2af · Note
• https://github.com/xwikisas/xwiki-pro-macros/blob/93ac1a38c829e3ef787379b2b45eb043a573e5f7/xwiki-pro-macros-confluence-bridges/xwiki-pro-macros-confluence-bridges-ui/src/main/resources/Confluence/Macros/ConfluencePasteCodeMacro.xml#L435 · Note
• https://github.com/xwikisas/xwiki-pro-macros/security/advisories/GHSA-5w8v-h22g-j2mp · Note
• https://jira.xwiki.org/browse/XWIKI-20449 · Note
• https://twitter.com/CVEnew/status/1965509622279893057 · Twitter Post
• https://twitter.com/CCBalert/status/1965791864541364575 · Twitter Post