CVE-2026-44179
CriticalCVSS 9.9Summary
The `excerpt-include` macro in XWiki Remote Macros does not properly escape the included page's title and executes `excerpt` content with the macro's rights. Both the title handling and the rendering of `excerpt` content into XWiki syntax allow syntax injection. Any user able to edit a page, even without script rights, can supply executable macro syntax and cause remote code execution when the page is included.
Risk Assessment
The vulnerability enables remote code execution in the XWiki server context by a low-privileged user, affecting confidentiality, integrity and availability of the whole installation.
Recommendation
Update XWiki Remote Macros to version 1.14.5 or later. Until patched, restrict page editing to trusted users.
Other vulnerabilities in XWiki Remote Macros
See all- CVE-2025-55728Critical
XWiki Remote Macros versions 1.0 through before 1.26.5 fail to escape the classes parameter in the panel macro, allowing XWiki syntax injection and remote code execution by any user who can edit any page. Version 1.26.5 contains a patch.
- CVE-2025-55727Critical
XWiki Remote Macros versions 1.0 through before 1.26.5 fail to escape the width parameter in the column macro, allowing XWiki syntax injection. This enables remote code execution for users who can edit pages or access the CKEditor converter.
- CVE-2025-65089Medium
In XWiki Remote Macros prior to version 1.27.0, a user with no view rights on a page may see the content of an office attachment displayed with the view file macro. This issue has been patched in version 1.27.0.
Original NVD description (English source)
XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence. From 1.13 until 1.14.5, the `excerpt-include` macro does not properly escape the included page's title and executes `excerpt` content with the macro's rights. The title handling in `xwiki-pro-macros-ui/src/main/resources/Confluence/Macros/ExcerptInclude.xml` and the rendering of `excerpt` content into XWiki syntax both allow syntax injection. Any user able to edit a page, even without script or programming rights, can supply executable macro syntax in the title or `excerpt` and cause remote code execution when the page is included. This affects confidentiality, integrity and availability of the whole XWiki installation. This issue is fixed in version 1.14.5.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS