# CVE-2026-44179: XWiki Pro Macros remote code execution in excerpt-include macro

Source: https://junglewise.ai/threats/cve-2026-44179-xwiki-pro-macros-remote-code-execution-in-excerpt-include-macro  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-28. Updated: 2026-06-22  
License: CC BY 4.0 with a link back

CVE-2026-44179 · Severity: critical · CVSS 9.9 · Published 2026-10-28

A vulnerability in the XWiki Pro Macros library allows users with basic page editing permissions to execute arbitrary code on the server. This occurs because the software fails to properly sanitize page titles and content when using the excerpt-include macro. An attacker could exploit this to gain full control over the XWiki installation, potentially leading to data theft, service disruption, or unauthorized access to sensitive information.

Vendors: [Maven](https://junglewise.ai/threats/vendors/maven).

## Quick answers

**Is CVE-2026-44179 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-44179 being exploited in the wild.

**How severe is CVE-2026-44179?** Critical severity, with a CVSS score of 9.9, published 28 October 2026.

**Which products and versions are affected?** com.xwiki.pro:xwiki-pro-macros (Maven) >= 1.13, < 1.14.5, ECOSYSTEM:introduced=1.13,fixed=1.14.5.

**Is there a fix for CVE-2026-44179?** Yes. com.xwiki.pro:xwiki-pro-macros (Maven): upgrade to 1.14.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-44179 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-44179?** Check whether you run com.xwiki.pro:xwiki-pro-macros (Maven) or XWiki SAS Pro Macros at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- com.xwiki.pro:xwiki-pro-macros (Maven): upgrade to 1.14.5 or later

  ```sh
  # set com.xwiki.pro:xwiki-pro-macros to 1.14.5 in your pom.xml or build.gradle
  ```


## Technical details

The excerpt-include macro in XWiki Pro Macros fails to properly escape the title of an included page and executes the content of the excerpt with the macro's elevated privileges. This is classified as an 'Eval Injection' (CWE-95) where XWiki syntax injection can be achieved via the included page's metadata or content. An attacker with low-level 'edit' permissions can craft a page with malicious Groovy or script directives in the title or content; when this page is processed by the excerpt-include macro, the code is executed on the server. The vulnerability is patched in version 1.14.5.

## Affected products

- XWiki SAS xwiki-pro-macros >= 1.13, < 1.14.5

## Identifiers

- CVE-2026-44179
- GHSA-w56x-9778-rppx

## Timeline

- 2026-06-21: disclosed
- 2026-06-22: advisory: GHSA-w56x-9778-rppx published
- 2026-06-22: patched: Version 1.14.5 released

## References

- [https://api.github.com/users/michitux](https://api.github.com/users/michitux)
- [https://github.com/michitux](https://github.com/michitux)
- [https://api.github.com/users/michitux/gists%7B/gist_id%7D](https://api.github.com/users/michitux/gists%7B/gist_id%7D)
- [https://api.github.com/users/michitux/repos](https://api.github.com/users/michitux/repos)
- [https://avatars.githubusercontent.com/u/198317?v=4](https://avatars.githubusercontent.com/u/198317?v=4)
- [https://api.github.com/users/michitux/events%7B/privacy%7D](https://api.github.com/users/michitux/events%7B/privacy%7D)