XWiki Pro Macros CVE-2026-44179
CRITICAL
GHSA-w56x-9778-rppx
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Network-reachable wiki, any edit-rights user suffices (PR:L), no user interaction, macro sandbox escape yields scope change with full host CIA impact.
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
3DescriptionGitHub Advisory
Summary
The excerpt-include macro does not properly escape the title of the included page and executes the content of the excerpt with the macro's rights. Therefore, it is vulnerable to XWiki syntax injection via the included page's title and content, allowing remote code execution for any user who can edit a page.
Details
The title of the included page isn't escaped in ExcerptInclude.xml#L277. Further, the content of the excerpt macro is rendered to XWiki syntax and output into the macro's content such that it is executed with the macro's rights.
PoC
- As a user without script or programming right, create a page named
Exploit. - In the edit screen, change the title to
{{async}}{{groovy}}println("Hello from Groovy Title!"){{/groovy}}{{/async}}. - Set the content to
{{excerpt-include 0="Exploit.WebHome"}}{{/excerpt-include}}
{{excerpt}}
{{async}}{{groovy}}println("Hello from Groovy content!"){{/groovy}}{{/async}}
{{/excerpt}}- Save and view the page.
- If this displays "Hello from Groovy Title!" without the surrounding macro code or "Hello from Groovy content!", the attack succeeded.
Impact
Remote code execution impacts the confidentiality, integrity and availability of the whole XWiki installation.
AnalysisAI
Remote code execution in XWiki Pro Macros (com.xwiki.pro:xwiki-pro-macros) versions >=1.13 and <1.14.5 allows any authenticated user with page-edit rights to execute arbitrary Groovy code via the excerpt-include macro, which fails to escape the included page's title and renders excerpt content with the macro's elevated rights. A working proof-of-concept is published in the GHSA advisory demonstrating injection through both a crafted page title and excerpt body. No public exploit identified at time of analysis as actively used, but the publicly available exploit code exists in the advisory itself.
Technical ContextAI
XWiki is an enterprise wiki platform that uses a custom macro/scripting language; the xwiki-pro-macros package provides Confluence-compatible macros including excerpt-include, implemented in ExcerptInclude.xml. The root cause is CWE-95 (Improper Neutralization of Directives in Dynamically Evaluated Code - Eval Injection): at ExcerptInclude.xml#L277 the included page's title is concatenated into XWiki syntax without escaping, and the excerpt body is re-rendered to XWiki syntax inside the macro's privileged execution context. Because XWiki macros such as {{groovy}} wrapped in {{async}} are evaluated server-side with the rights of the macro author rather than the caller, syntax injected by a low-privileged editor inherits the higher privileges of whoever last saved the macro definition, yielding code execution on the JVM hosting XWiki.
RemediationAI
Vendor-released patch: upgrade com.xwiki.pro:xwiki-pro-macros to version 1.14.5 or later, as fixed by xwikisas and documented at https://github.com/xwikisas/xwiki-pro-macros/security/advisories/GHSA-w56x-9778-rppx. If immediate upgrade is not possible, uninstall or disable the excerpt-include macro from the wiki (this will break any pages that legitimately use Confluence-style excerpt inclusion, so audit usage first), and tighten edit permissions on the wiki so that only trusted users can create or modify pages, accepting that this reduces collaboration. As an additional compensating control, remove or restrict the {{groovy}} and other scripting macros for users without programming rights and audit existing pages whose titles contain XWiki macro syntax such as {{async}} or {{groovy}}, since the bug allows the title field to smuggle macro directives.
Atlassian has been made aware of an issue reported by a handful of customers where external attackers may have exploited
The HipChat for JIRA plugin before 6.30.0 for Atlassian JIRA allows remote authenticated users to execute arbitrary Java
Atlassian Confluence before 5.8.17 allows remote authenticated users to read configuration files via the decoratorName p
Atlassian JIRA before 5.0.1; Confluence before 3.5.16, 4.0 before 4.0.7, and 4.1 before 4.1.10; FishEye and Crucible bef
Directory traversal vulnerability in the Issue Collector plugin in Atlassian JIRA before 6.0.4 allows remote attackers t
All versions of Confluence Data Center and Server are affected by this unexploited vulnerability. Rated critical severit
There is a command injection vulnerability using environment variables in Bitbucket Server and Data Center. Rated critic
In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an un
Atlassian Crowd and Crowd Data Center had the pdkinstall development plugin incorrectly enabled in release builds. Rated
The IconUriServlet of the Atlassian OAuth Plugin from version 1.3.0 before version 1.9.12 and from version 2.0.0 before
This High severity RCE (Remote Code Execution) vulnerability was introduced in version 5.2 of Confluence Data Center and
Multiple API endpoints in Atlassian Bitbucket Server and Data Center 7.0.0 before version 7.6.17, from version 7.7.0 bef
Same weakness CWE-95 – Eval Injection
View allShare
External POC / Exploit Code
Leaving vuln.today