CVE-2025-65089CWE-862broken-access-control

CVE-2025-65089

Medium · published November 19, 2025

CVSS v3.1

6.8

EPSS

Percentile

21.1

In the wild

Unconfirmed

What it is

XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence. Prior to version 1.27.0, a user with no view rights on a page may see the content of an office attachment displayed with the view file macro. This issue has been patched in version 1.27.0.

The record

Technical detail

CVSS v3.1: 6.8 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N
CVSS v4.0: Not supplied
EPSS: 0.00296 · 21.1th percentile
Weakness: CWE-862 · Missing Authorization
Published: 2025-11-19T23:15Z

Affected products (1)

Product	Versions	Fixed in
xwiki/pro_macros	< 1.27.0	1.27.0

References (2)

https://github.com/xwikisas/xwiki-pro-macros/security/advisories/GHSA-8c52-x9w7-vc95 · [email protected]https://github.com/xwikisas/xwiki-pro-macros/security/advisories/GHSA-8c52-x9w7-vc95 · 134c704f-9b21-4f2e-91b3-4a467353bcc0

EPSS history

Timeline

19 NOV 17:41Z
XWiki view file macro: User can view content of office file without view rights on the attachment
cvelistv5