Auth bypass in Xwiki Pro Macros
CVE-2025-65036
XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence. Prior to 1.27.1, the macro executes Velocity from the details pages without checking for permissions, which can lead to remote code execution. This vulnerability is fixed in 1.27.1.
Vulnerability class: Broken Access Control
EPSS: 0.004 (28.2th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.3 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L.
Affected products
- Xwiki Pro_macros
- Xwikisas Xwiki-pro-macros — versions < 1.27.1
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM, Vendor Advisory)
Frequently asked questions
- What is CVE-2025-65036?
- CVE-2025-65036 is a high-severity vulnerability in Xwiki Pro Macros, classified under Missing Authorization. CVSS score: 8.3/10. Published 2025-12-05.
- How severe is CVE-2025-65036?
- High severity. CVSS v3 base score is 8.3 out of 10.