PT-2025-36918

CVE-2025-55728

Published

2025-09-09

Updated

2025-09-17

Description by

CVSS 3.1

Critical

MetricsAV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: XWiki Remote Macros versions 1.0 through 1.26.5

Description: XWiki Remote Macros provides XWiki rendering macros used for content migration from Confluence. A lack of escaping for the classes parameter within the panel macro allows for remote code execution. This affects any user with page editing permissions, as the classes parameter is used without proper escaping in XWiki syntax, enabling XWiki syntax injection.

Recommendations: Update to version 1.26.5 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Vendors

Affected products

Weakness enumeration

CWE-94: Improper Control of Generation of Code (\'Code Injection\')

CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code (\'Eval Injection\')

Related identifiers