External risk intelligence

XWiki Remote Macros Panel Macro Injection Allows Remote Code Execution.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2025-55728

The vulnerability affects XWiki, a collaborative software platform that is frequently deployed as a public-facing web application. Since the issue exists within a macro used for rendering content and requires page-editing capabilities, and given that XWiki instances are commonly exposed to the internet to serve their intended purpose as knowledge management or collaboration portals, the attack surface is considered likely to be internet-facing.

Code Injection

Xwiki Pro Macros

1.0 to before 1.26.5

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability has been identified in XWiki Pro Macros that could allow for remote code execution by users with page editing privileges. This issue stems from improper handling of certain parameters within the panel macro, potentially enabling malicious code injection. The primary concern is confirming the relevance and exposure of this technology within our environment.

Code execution risk in content macros.
Remember: Unescaped macro input allows code injection.
Confirm relevance and exposure to XWiki Pro Macros.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by injecting specially crafted XWiki syntax into the `classes` parameter of the panel macro. This injection bypasses security measures because the parameter is not properly escaped before being processed by the macro. If successful, an attacker could achieve remote code execution, leading to a complete compromise of the affected system.

Requires ability to edit any page.
Inject XWiki syntax into the `classes` parameter.
Remote code execution leading to system compromise.

Live Threat

Current exploitation, exposure, and threat context

A vulnerability in XWiki Remote Macros, specifically within the panel macro's classes parameter, could allow remote code execution. This occurs when users with page editing privileges inject XWiki syntax, enabling malicious code execution on the server. This could impact the integrity and availability of the XWiki instance.

Server-side code execution is at risk.
Malicious syntax injection may occur.
System compromise is a realistic consequence.

Operational Fix

Recommended remediation, mitigation, and detection steps

Application owners and infrastructure teams are likely responsible for addressing this vulnerability in XWiki Remote Macros, as it allows for remote code execution due to unescaped parameters in the panel macro. The first practical move is to identify all instances of the affected XWiki pro_macros, determine their reachability and business criticality, and then assign ownership for remediation planning based on the assessed risk.

Identify affected XWiki pro_macros instances.
Verify reachability and business criticality.
Plan remediation based on risk assessment.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the XWiki Remote Macros product?

XWiki Remote Macros is an extension for the XWiki collaboration platform designed to assist users in migrating content from other systems, like Confluence. It includes specialized rendering macros, such as the panel macro, to help maintain formatting and structure when bringing information into XWiki's knowledge management environment.

What does CWE-94 and CWE-95 mean for CVE-2025-55728?

These codes identify weaknesses where software improperly handles user input, leading to code injection. In this specific vulnerability, the application fails to sanitize the 'classes' parameter in the panel macro. Because the input is treated as executable instructions rather than plain text, a user can inject custom syntax that the server then runs, resulting in unauthorized remote code execution.

How is this vulnerability triggered?

An attacker must be able to edit a page within the XWiki instance to trigger the flaw. By inserting malicious XWiki syntax into the 'classes' parameter of the panel macro, the attacker forces the system to process that input as code. Simply viewing a page or having standard read-only access is not enough to initiate this injection.

Why is this a concern for internet-facing XWiki instances?

Halo Surface Signal classifies this as likely internet-facing because XWiki is frequently deployed as a public portal for collaboration. If an XWiki instance is accessible over the internet, the potential for an attacker to reach page-editing functions increases, making the remote code execution risk more significant for those exposed platforms.

What should I do if I run XWiki Pro Macros?

Your first step is to locate all instances of the XWiki pro_macros extension within your environment to determine which systems are affected. Once identified, evaluate the business criticality and network reachability of these instances. You should prioritize updating to version 1.26.5 or later, as this release contains the necessary patch to safely handle the macro's parameters.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.