Critical · published September 9, 2025
🔥 A missing escape in the XWiki column macro is a gift-wrapped invitation for remote code execution! Just imagine the chaos if anyone editing a page can execute their own code! 🚨 Think of the XWiki Remote Macros like a restaurant where the chef (the editor) can prepare any dish (code) without supervision. If the chef accidentally adds the wrong ingredients (unsanitized input), it could lead to a culinary disaster, with the wrong orders reaching every table (executing malicious code across the wiki). An attacker could waltz in, execute arbitrary code, and take control of the server! This means they could access sensitive data, manipulate content, or even take over admin privileges. It's a recipe for disaster that could lead to a full compromise of your XWiki instance!
Think of the XWiki Remote Macros like a restaurant where the chef (the editor) can prepare any dish (code) without supervision. If the chef accidentally adds the wrong ingredients (unsanitized input), it could lead to a culinary disaster, with the wrong orders reaching every table (executing malicious code across the wiki). This vulnerability arises from the XWiki column macro not properly escaping the width parameter, allowing syntax injection that can be exploited by users with edit permissions. If exploited, attackers can execute arbitrary Velocity code with the potential rights of the wiki admin.
An attacker could waltz in, execute arbitrary code, and take control of the server! This means they could access sensitive data, manipulate content, or even take over admin privileges. It's a recipe for disaster that could lead to a full compromise of your XWiki instance! Immediately upgrade to XWiki version 1.26.5 or later to apply the security patch. Additionally, review user permissions to ensure that only trusted users have the ability to edit pages. Regular audits of custom macros can further bolster your defenses. You've got this! Implement these steps, and you'll have your XWiki locked down in no time. 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| xwiki/pro_macros | ≥ 1.0, < 1.26.5 | 1.26.5 |