External risk intelligence

XWiki Remote Macros Confluence Paste Code Macro Allows Remote Code Execution

CVE advisorySeverity: CRITICAL (CVSS 10.0)

CVE-2025-55730

The vulnerability exists in an XWiki macro used for content migration. While XWiki instances are often web-accessible, this specific issue requires an attacker to have permissions to edit a page within the application to trigger the macro injection. Because the vulnerability is contingent on internal user access rather than being directly exposed as a public-facing service, it is categorized as Possible.

Remote Code Execution

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability impacts XWiki macros used for migrating content from Confluence. It allows for remote code execution if an attacker can edit any page within the application, potentially leading to a significant compromise of the affected XWiki instance. The main concern is confirming if your environment uses this specific macro for migration and if an attacker could gain page editing privileges.

Unsanitized text in a migration tool enables code execution.
High impact vulnerability could affect your wiki content.
Confirm usage and access to this specific migration macro.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by injecting malicious XWiki syntax into a page that uses the confluence paste code macro. This injection is possible because the macro does not properly escape user-supplied data, specifically the "title" parameter. If a user with editing privileges adds content using this macro with specially crafted input, the attacker can achieve remote code execution.

Any authenticated user with edit access.
Injecting code via the macro's title.
Remote code execution and data compromise.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated remote attacker to execute arbitrary code on the affected XWiki instance when supported by the advisory. This could occur if an attacker crafts specific input within a page that is then processed by the vulnerable macro, leading to the execution of malicious commands.

System data could be compromised.
Unauthenticated remote code execution is possible.
Complete system compromise may occur.

Operational Fix

Recommended remediation, mitigation, and detection steps

System owners and platform teams are likely responsible for addressing this critical vulnerability in XWiki Remote Macros, particularly within the Confluence paste code macro. The first practical step involves identifying all instances of the affected XWiki macro, confirming their reachability and business criticality, and then locating the accountable owner to plan remediation.

Platform teams own the issue.
Verify macro reachability and criticality.
Plan remediation during maintenance windows.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the XWiki Remote Macros component?

XWiki Remote Macros is an extension used to facilitate the migration of documentation and content from Confluence to XWiki. It includes specific tools, such as the confluence paste code macro, designed to help users transition their existing information into the XWiki platform while maintaining formatting.

How does CVE-2025-55730 cause a security risk?

This vulnerability is classified as Improper Encoding (CWE-116). It occurs because the macro fails to properly sanitize the title parameter before processing it. This weakness allows an attacker to inject malicious XWiki syntax, which the system then inadvertently executes, potentially granting the attacker complete control over the application.

Do I need edit permissions to trigger this vulnerability?

Yes, this bug is specifically triggered when someone with page-editing privileges supplies malicious input into the vulnerable macro's title parameter. It is not triggered by simple page viewing; the attack path requires the ability to save or modify content that uses this specific migration macro.

Is my XWiki instance at risk according to Halo Surface Signal?

Halo Surface Signal indicates that while many XWiki instances are web-accessible, this specific vulnerability is contingent on internal access. Because it requires the ability to edit pages, it is categorized as a 'Possible' risk rather than a directly exposed public-facing service, though the impact remains high if an attacker gains such access.

What is the first step to remediate CVE-2025-55730?

Begin by auditing your environment to determine if the XWiki Remote Macros package is installed and if the confluence paste code macro is actively used. If found, coordinate with your platform team to update to version 1.26.5 or higher, which includes the necessary escaping fixes to prevent this syntax injection.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.