{"id":"CVE-2026-44179","title":"XWiki Pro Macros: excerpt-include title and content injection executes code","summary":"XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence. From 1.13 until 1.14.5, the `excerpt-include` macro does not properly escape the included page's title and executes `excerpt` con…","severity":"critical","cvss":9.9,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cvssSource":"cna","cwe":["CWE-95"],"vendor":"xwikisas","product":"xwiki-pro-macros","affected":["xwiki-pro-macros >= 1.13, < 1.14.5"],"published":"2026-10-28","updated":"2026-10-28","sourceUpdated":"2026-10-28T15:35:45.630Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-44179","references":[{"url":"https://github.com/xwikisas/xwiki-pro-macros/security/advisories/GHSA-w56x-9778-rppx","label":"https://github.com/xwikisas/xwiki-pro-macros/security/advisories/GHSA-w56x-9778-rppx"},{"url":"https://github.com/xwikisas/xwiki-pro-macros/commit/151d4fccb62f6ec5f3c972e837869454677ab1ca","label":"https://github.com/xwikisas/xwiki-pro-macros/commit/151d4fccb62f6ec5f3c972e837869454677ab1ca"},{"url":"https://github.com/xwikisas/xwiki-pro-macros/releases/tag/xwiki-pro-macros-1.14.5","label":"https://github.com/xwikisas/xwiki-pro-macros/releases/tag/xwiki-pro-macros-1.14.5"},{"url":"https://github.com/advisories/GHSA-w56x-9778-rppx"}],"tags":["cve.org","ghsa","maven"],"ecosystem":"maven","patched":["com.xwiki.pro:xwiki-pro-macros 1.14.5"],"ingestedAt":"2026-06-29T13:24:35.516Z","slug":"CVE-2026-44179","body":"## Overview\n\nXWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence. From 1.13 until 1.14.5, the `excerpt-include` macro does not properly escape the included page's title and executes `excerpt` content with the macro's rights. The title handling in `xwiki-pro-macros-ui/src/main/resources/Confluence/Macros/ExcerptInclude.xml` and the rendering of `excerpt` content into XWiki syntax both allow syntax injection. Any user able to edit a page, even without script or programming rights, can supply executable macro syntax in the title or `excerpt` and cause remote code execution when the page is included. This affects confidentiality, integrity and availability of the whole XWiki installation. This issue is fixed in version 1.14.5.\n\n## Affected\n\n- `xwiki-pro-macros >= 1.13, < 1.14.5`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-44179)\n\nAffected packages:\n\n- `com.xwiki.pro:xwiki-pro-macros >= 1.13, < 1.14.5`\n\nPatched in:\n\n- `com.xwiki.pro:xwiki-pro-macros 1.14.5`\n\nSource: https://github.com/advisories/GHSA-w56x-9778-rppx","depth":"midnight","depthScore":54,"depthScoreParts":{"impact":54.5,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}