Executive brief
A vulnerability in the XWiki Pro Macros library allows users with basic page editing permissions to execute arbitrary code on the server. This occurs because the software fails to properly sanitize page titles and content when using the excerpt-include macro. An attacker could exploit this to gain full control over the XWiki installation, potentially leading to data theft, service disruption, or unauthorized access to sensitive information.
Technical details
The excerpt-include macro in XWiki Pro Macros fails to properly escape the title of an included page and executes the content of the excerpt with the macro's elevated privileges. This is classified as an 'Eval Injection' (CWE-95) where XWiki syntax injection can be achieved via the included page's metadata or content. An attacker with low-level 'edit' permissions can craft a page with malicious Groovy or script directives in the title or content; when this page is processed by the excerpt-include macro, the code is executed on the server. The vulnerability is patched in version 1.14.5.
Affected products
- XWiki SAS xwiki-pro-macros >= 1.13, < 1.14.5
Timeline
- 2026-06-21: disclosed
- 2026-06-22: advisory: GHSA-w56x-9778-rppx published
- 2026-06-22: patched: Version 1.14.5 released