CVE-2025-65089: fallo de gravedad media en xwikisas xwiki-pro-macros
XWiki view file macro: User can view content of office file without view rights on the attachment
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 6.8epss 0.3%
XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence. Prior to version 1.27.0, a user with no view rights on a page may see the content of an office attachment displayed with the view file macro. This issue has been patched in version 1.27.0.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N
Productos afectados
xwikisas · xwiki-pro-macrosCVEs relacionadas — xwikisas xwiki-pro-macros
En el mismo producto, de las más peligrosas a las menos.
CVE-2024-42489CRITICALPro Macros Remote Code Execution via Viewpdf and similar macrosEPSS 1.1%CVE-2025-55727CRITICALXWiki Remote Macros vulnerable to remote code execution from width parameter in the column macroEPSS 1.0%CVE-2025-55728CRITICALXWiki Remote Macros vulnerable to remote code execution using the panel macroEPSS 0.8%CVE-2025-55730CRITICALXWiki Remote Macros vulnerable to remote code execution using the confluence paste code macroEPSS 0.7%CVE-2025-55729CRITICALXWiki Remote Macros vulnerable to remote code execution using the ConfluenceLayoutSection macroEPSS 0.7%CVE-2026-44179CRITICALXWiki Pro Macros: excerpt-include title and content injection executes codeEPSS 0.7%