High · published December 5, 2025
⚡ A sneaky oversight in XWiki means anyone can execute code remotely by simply using a macro. If you're not on version 1.27.1, it's time to take action! 🚀 Think of it like a restaurant that lets customers directly access the kitchen through a door that should be locked. Without a proper check, anyone could wander in and tamper with the menu or even throw a wild party! This vulnerability allows an attacker to run arbitrary code on your server. They could manipulate the system, access sensitive data, or even bring your entire service to a standstill—absolutely devastating for any organization relying on XWiki.
Think of it like a restaurant that lets customers directly access the kitchen through a door that should be locked. Without a proper check, anyone could wander in and tamper with the menu or even throw a wild party! This flaw in XWiki Remote Macros allows the execution of Velocity scripts from details pages without proper permission checks. Essentially, an attacker can inject and execute malicious code remotely, leading to potential remote code execution (RCE).
This vulnerability allows an attacker to run arbitrary code on your server. They could manipulate the system, access sensitive data, or even bring your entire service to a standstill—absolutely devastating for any organization relying on XWiki. Update XWiki to version 1.27.1 immediately to close this security gap. Review your application for any other outdated components and implement strict permissions to safeguard your macros in the future. You've got this! By acting quickly, you'll keep your systems safe and secure. 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| xwiki/pro_macros | < 1.27.1 | 1.27.1 |