EUVD-2026-112144
GHSA-w56x-9778-rppx
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconObtain low-privileged editor account
-
DeliveryCreate page with malicious macro syntax in title
-
ExploitAdd excerpt-include referencing that page
-
InstallTrigger render of crafted page
-
C2Unescaped title evaluated as XWiki macro
-
ExecuteGroovy executes with macro author rights
-
ImpactFull XWiki host compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Eval input sanitization
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated XWiki account with permission to create or edit at least one page on the target wiki (no script or programming rights are needed - ordinary edit rights suffice), and the xwiki-pro-macros package version >=1.13 and <1.14.5 must be installed with the excerpt-include macro enabled. Exploitation also depends on the excerpt-include macro having been saved by a user with programming rights at some point (so that the macro author's rights it inherits are privileged enough to evaluate {{groovy}}), which is the default for the vendor-shipped macro. Limiting factors: closed-registration wikis where only trusted staff have edit rights significantly shrink the attacker pool, and removing or disabling the excerpt-include macro neutralizes the vector. |
| Impact | The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H (9.9 Critical) is well supported: exploitation is network-reachable, requires only an ordinary editing account (PR:L), no user interaction, and changes scope by escaping the macro sandbox to compromise the host JVM with full CIA impact. EPSS and CISA KEV data were not provided, but a fully weaponizable PoC is embedded in the GHSA advisory, which materially raises real-world risk versus a purely theoretical injection. The most important caveat is the prerequisite of an authenticated editor account - on hardened internet-facing wikis with restricted registration this narrows the attacker pool, while on collaborative or open-registration deployments it is effectively unauthenticated-equivalent. Overall this is a genuine priority for any XWiki deployment running the affected package, not a high-CVSS-but-low-real-risk issue. |
| Exploit ScenarioDerived | A low-privileged user with only page-edit rights creates a page whose title contains {{async}}{{groovy}}...{{/groovy}}{{/async}}, then adds an excerpt-include macro referencing that page; when any viewer (or the attacker themselves) renders the page, the unescaped title is parsed as XWiki syntax and the Groovy block executes server-side with the macro author's rights, giving the attacker arbitrary code execution on the XWiki host. The published PoC in the GHSA advisory provides copy-pasteable payloads, so weaponization effort is essentially zero. Publicly available exploit code exists. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 22, 2026
Remote code execution in XWiki Pro Macros (com.xwiki.pro:xwiki-pro-macros) versions >=1.13 and <1.14.5 allows any authenticated user with page-edit rights to execute arbitrary Groovy code via the excerpt-include macro, which fails to escape the included page's title and renders excerpt content with the macro's elevated rights. A working proof-of-concept is published in the GHSA advisory demonstrating injection through both a crafted page title and excerpt body. No public exploit identified at time of analysis as actively used, but the publicly available exploit code exists in the advisory itself.
RemediationAI
Vendor-released patch: upgrade com.xwiki.pro:xwiki-pro-macros to version 1.14.5 or later, as fixed by xwikisas and documented at https://github.com/xwikisas/xwiki-pro-macros/security/advisories/GHSA-w56x-9778-rppx. If immediate upgrade is not possible, uninstall or disable the excerpt-include macro from the wiki (this will break any pages that legitimately use Confluence-style excerpt inclusion, so audit usage first), and tighten edit permissions on the wiki so that only trusted users can create or modify pages, accepting that this reduces collaboration. As an additional compensating control, remove or restrict the {{groovy}} and other scripting macros for users without programming rights and audit existing pages whose titles contain XWiki macro syntax such as {{async}} or {{groovy}}, since the bug allows the title field to smuggle macro directives.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in maven, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
XWiki is an enterprise wiki platform that uses a custom macro/scripting language; the xwiki-pro-macros package provides Confluence-compatible macros including excerpt-include, implemented in ExcerptInclude.xml. The root cause is CWE-95 (Improper Neutralization of Directives in Dynamically Evaluated Code - Eval Injection): at ExcerptInclude.xml#L277 the included page's title is concatenated into XWiki syntax without escaping, and the excerpt body is re-rendered to XWiki syntax inside the macro's privileged execution context. Because XWiki macros such as {{groovy}} wrapped in {{async}} are evaluated server-side with the rights of the macro author rather than the caller, syntax injected by a low-privileged editor inherits the higher privileges of whoever last saved the macro definition, yielding code execution on the JVM hosting XWiki.
Know when Atlassian gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Network-reachable wiki, any edit-rights user suffices (PR:L), no user interaction, macro sandbox escape yields scope change with full host CIA impact.
Primary rating from Vendor (https://github.com/xwikisas/xwiki-pro-macros).
CVSS VectorVendor: https://github.com/xwikisas/xwiki-pro-macros
DescriptionCVE.org
Summary
The excerpt-include macro does not properly escape the title of the included page and executes the content of the excerpt with the macro's rights. Therefore, it is vulnerable to XWiki syntax injection via the included page's title and content, allowing remote code execution for any user who can edit a page.
Details
The title of the included page isn't escaped in ExcerptInclude.xml#L277. Further, the content of the excerpt macro is rendered to XWiki syntax and output into the macro's content such that it is executed with the macro's rights.
PoC
- As a user without script or programming right, create a page named
Exploit. - In the edit screen, change the title to
{{async}}{{groovy}}println("Hello from Groovy Title!"){{/groovy}}{{/async}}. - Set the content to
{{excerpt-include 0="Exploit.WebHome"}}{{/excerpt-include}}
{{excerpt}}
{{async}}{{groovy}}println("Hello from Groovy content!"){{/groovy}}{{/async}}
{{/excerpt}}- Save and view the page.
- If this displays "Hello from Groovy Title!" without the surrounding macro code or "Hello from Groovy content!", the attack succeeded.
Impact
Remote code execution impacts the confidentiality, integrity and availability of the whole XWiki installation.
Executive ViewAI
XWiki Pro Macros versions 1.13 through 1.14.4 contain a critical vulnerability allowing any page editor to execute arbitrary code on the application server. Publicly available exploit code exists. Organizations using these versions face potential full system compromise through attackers leveraging normal page-editing privileges.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict page-edit rights to essential personnel only, (2) require code review before publishing page edits, (3) implement network segmentation to limit blast radius of remote code execution, (4) enable detailed logging and monitoring of macro and Groovy code execution.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Atlassian has been made aware of an issue reported by a handful of customers where external attackers may have exploited
The HipChat for JIRA plugin before 6.30.0 for Atlassian JIRA allows remote authenticated users to execute arbitrary Java
Atlassian Confluence before 5.8.17 allows remote authenticated users to read configuration files via the decoratorName p
Atlassian JIRA before 5.0.1; Confluence before 3.5.16, 4.0 before 4.0.7, and 4.1 before 4.1.10; FishEye and Crucible bef
Directory traversal vulnerability in the Issue Collector plugin in Atlassian JIRA before 6.0.4 allows remote attackers t
All versions of Confluence Data Center and Server are affected by this unexploited vulnerability. Rated critical severit
There is a command injection vulnerability using environment variables in Bitbucket Server and Data Center. Rated critic
In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an un
Atlassian Crowd and Crowd Data Center had the pdkinstall development plugin incorrectly enabled in release builds. Rated
The IconUriServlet of the Atlassian OAuth Plugin from version 1.3.0 before version 1.9.12 and from version 2.0.0 before
This High severity RCE (Remote Code Execution) vulnerability was introduced in version 5.2 of Confluence Data Center and
Multiple API endpoints in Atlassian Bitbucket Server and Data Center 7.0.0 before version 7.6.17, from version 7.7.0 bef
Exploit-DB