CVE-2025-65089
MediumCVSS 6.8Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
In XWiki Remote Macros prior to version 1.27.0, a user with no view rights on a page may see the content of an office attachment displayed with the view file macro. This issue has been patched in version 1.27.0.
Risk Assessment
Unauthorized disclosure of attachment content to users who should not have access may occur. This is a confidentiality breach in the XWiki environment.
Recommendation
Upgrade XWiki Remote Macros to version 1.27.0 or later. Verify that no sensitive attachments were exposed to unauthorized users.
Other vulnerabilities in XWiki Remote Macros
See all- CVE-2025-55728Critical
XWiki Remote Macros versions 1.0 through before 1.26.5 fail to escape the classes parameter in the panel macro, allowing XWiki syntax injection and remote code execution by any user who can edit any page. Version 1.26.5 contains a patch.
- CVE-2025-55727Critical
XWiki Remote Macros versions 1.0 through before 1.26.5 fail to escape the width parameter in the column macro, allowing XWiki syntax injection. This enables remote code execution for users who can edit pages or access the CKEditor converter.
Original NVD description (English source)
XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence. Prior to version 1.27.0, a user with no view rights on a page may see the content of an office attachment displayed with the view file macro. This issue has been patched in version 1.27.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS