PT-2025-36929

CVE-2025-55729

Published

2025-09-09

Updated

2025-09-10

Description by

CVSS 3.1

Critical

MetricsAV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: XWiki Remote Macros versions 1.0 through 1.26.5

Description: XWiki Remote Macros provides XWiki rendering macros used for migrating content from Confluence. A missing escaping mechanism in the ac:type parameter within the ConfluenceLayoutSection macro allows for remote code execution. The classes parameter is used without proper escaping in XWiki syntax, enabling XWiki syntax injection, which also leads to remote code execution.

Recommendations: Update to version 1.26.5 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Michael Hamann

Vendors

Affected products

Weakness enumeration

CWE-116: Improper Encoding or Escaping of Output

Related identifiers