CVE-2025-55728
Published: 09 September 2025
Summary
CVE-2025-55728 is a critical-severity Eval Injection (CWE-95) vulnerability in Xwiki Pro Macros. Its CVSS base score is 10.0 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 11.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Requires validation and sanitization of the unescaped 'classes' parameter to prevent XWiki syntax injection and subsequent RCE.
Mandates filtering and escaping of the 'classes' parameter when rendered in XWiki syntax to block code injection attacks.
Ensures timely remediation by patching the XWiki Remote Macros extension to version 1.26.5 or later, which fixes the escaping vulnerability.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Missing input escaping in public-facing XWiki macro directly enables unauthenticated remote code execution via syntax injection in a web application.
NVD Description
XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence. Starting in version 1.0 and prior to version 1.26.5, missing escaping of the classes parameter in the panel macro allows remote code execution for any…
more
user who can edit any page The classes parameter is used without escaping in XWiki syntax, thus allowing XWiki syntax injection which enables remote code execution. Version 1.26.5 contains a patch for the issue.
Deeper analysisAI
CVE-2025-55728 affects the XWiki Remote Macros extension, which provides XWiki rendering macros for migrating content from Confluence. The vulnerability stems from missing escaping of the "classes" parameter in the panel macro, enabling XWiki syntax injection. This issue impacts versions from 1.0 up to but not including 1.26.5, allowing remote code execution (RCE) via unescaped usage of the parameter in XWiki syntax. It is classified under CWE-95 (Improper Neutralization of Directives in Dynamically Evaluated Code) and CWE-94 (Improper Control of Generation of Code), with a CVSS v3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).
Any user with the ability to edit a page can remotely exploit this vulnerability over the network with low complexity, no privileges, and no user interaction required. Successful exploitation changes the scope and grants high-impact confidentiality, integrity, and availability compromises through RCE on the affected XWiki instance.
Advisories and the patch details indicate that version 1.26.5 resolves the issue by addressing the escaping flaw, as documented in the GitHub security advisory GHSA-48f4-h726-74p5, the fixing commit, the vulnerable code location in Panel.xml, and XWiki Jira ticket XWIKI-20449. Security practitioners should upgrade to 1.26.5 or later to mitigate the risk.
Details
- CWE(s)