External risk intelligence

XWiki Remote Macros Title Injection Leads to Remote Code Execution

CVE advisorySeverity: CRITICAL (CVSS 9.9)

CVE-2026-44179

The vulnerability exists within a macro in the XWiki platform, which is commonly deployed as a web-based application. While the application itself may be internet-facing, this specific flaw requires a user to have existing permissions to edit a page within the system to trigger the injection, making it a possible but not inherently public-facing or pre-authentication attack surface.

Remote Code Execution

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability has been identified in the XWiki Remote Macros feature, specifically within the `excerpt-include` macro. This flaw allows a user with page editing access to inject malicious code, potentially leading to remote code execution and impacting the confidentiality, integrity, and availability of the entire XWiki installation.

Malicious code can be injected via macro titles or content.
Executive concern is confirming relevance and exposure.
Understand potential for remote code execution in XWiki.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by editing an existing page and injecting malicious code into the page's title or content. When another user views a page that includes this specially crafted content, the injected code is executed with the rights of the user editing the page, potentially leading to the compromise of the entire XWiki installation.

Requires ability to edit a page.
Injected code in page title or content.
Risk to confidentiality, integrity, availability.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, an authenticated user with page editing privileges could inject malicious macro syntax into a page's title or content. This injected syntax could then be executed when the page is included in another, potentially leading to the compromise of the entire XWiki installation's confidentiality, integrity, and availability.

XWiki installation data and services.
Via crafted page titles or excerpt content.
Full system compromise of XWiki.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability impacts XWiki installations where the `excerpt-include` macro is used, potentially affecting confidentiality, integrity, and availability. The primary action for technical leaders and security teams is to confirm the presence of this macro, identify the accountable owner, and assess the business criticality and reachability of affected XWiki instances before planning remediation.

Application or platform owners should manage remediation.
Verify `excerpt-include` macro usage and reachability.
Plan updates during maintenance windows.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is XWiki Remote Macros?

XWiki Remote Macros is an extension for the XWiki platform that provides rendering macros specifically designed to simplify the migration of content from Confluence to XWiki. These tools allow users to carry over existing documentation structures and formatting, including the 'excerpt-include' macro, which helps display snippets of content from one page on another.

What does CVE-2026-44179 mean for system security?

This vulnerability is classified as CWE-95, or Improper Neutralization of Directives in Dynamically Evaluated Code. In simple terms, the software fails to properly clean input, allowing an attacker to inject and execute their own macro commands. This grants the attacker unauthorized control over the XWiki environment, effectively bypassing standard restrictions to compromise the system's data and operations.

How is this vulnerability triggered?

An attacker triggers the flaw by injecting malicious macro syntax into a page's title or its excerpt content. Critically, this requires the attacker to have existing permission to edit a page within the application. Merely viewing a page or interacting with the site without page-editing privileges does not trigger this execution.

Is my XWiki instance at risk?

Halo Surface Signal indicates this is a possible risk because it relies on existing page-editing permissions. While the vulnerability exists in a web-based application that might be internet-facing, it is not a pre-authentication flaw. You should prioritize instances where untrusted users have been granted page-editing rights, as they are the primary candidates for exploiting this weakness.

What are the first steps to address this?

The most effective response is to update the XWiki Remote Macros extension to version 1.14.5 or later, where this issue is fully resolved. Before applying the update, verify if your installation uses the 'excerpt-include' macro, identify the team responsible for that specific XWiki instance, and schedule the update during your next maintenance window.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.