XWiki Remote Macros vulnerable to remote code execution using the panel macro

The impact of CVE-2025-55728 is severe. An attacker who can edit any page within the XWiki instance can exploit this vulnerability to achieve remote code execution. This means they could potentially gain full control of the server hosting the XWiki application, including access to sensitive data, modification of content, and installation of malicious software. The ability to inject XWiki syntax directly into the system bypasses standard security controls, making exploitation relatively straightforward for a skilled attacker. Lateral movement within the network is possible if the XWiki server has access to other systems or resources. The blast radius extends to any data stored or processed by the XWiki instance, as well as any systems accessible from the compromised server.

1. 已保留2025-08-14
2. 发布日期2025-09-09
3. 修改日期2025-09-11
4. EPSS 更新日期2026-03-23

The primary mitigation for CVE-2025-55728 is to upgrade XWiki Remote Macros to version 1.26.5 or later, which contains the necessary patch. If immediate upgrading is not possible due to compatibility issues or testing requirements, consider implementing temporary workarounds. These may include restricting user permissions to limit who can edit pages, or implementing a Web Application Firewall (WAF) rule to block requests containing suspicious XWiki syntax in the 'classes' parameter. Carefully review and validate any user-supplied input before rendering it within XWiki macros. After upgrading, confirm the fix by attempting to inject XWiki syntax into the 'classes' parameter of a panel macro and verifying that the injection is properly sanitized and does not result in code execution.