Remote Content Visibility Flaw in XWiki Rendering Macros by XWiki
CVE-2025-65089

6.8MEDIUM

Key Information:

Vendor

Xwikisas

Status
Xwiki-pro-macros
Vendor
CVE Published:
19 November 2025

What is CVE-2025-65089?

The XWiki Remote Macros component, which facilitates rendering helpful macros for migrating content from Confluence, contains a vulnerability that may allow users without appropriate view rights to access the content of Office attachments. This issue can be exploited through the view file macro, enabling unauthorized visibility of sensitive documents. The vulnerability was rectified in version 1.27.0, reinforcing the access control mechanisms and preventing unauthorized content exposure.

Affected Version(s)

xwiki-pro-macros < 1.27.0

References

https://github.com/xwikisas/xwiki-pro-macros/security/adv...
x_refsource_CONFIRM

CVSS V3.1

Score:
6.8
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.
CVE-2025-65089 : Remote Content Visibility Flaw in XWiki Rendering Macros by XWiki