Live › vulnerability › CVE-2026-44179
Go to dashboardXWiki Remote Macros from 1.13 up to 1.14.5 mishandles the title and excerpt content of the excerpt-include macro, letting any user who can edit a page inject macro syntax. The injected macro runs with the rights of the macro, so an attacker who only has edit rights can execute code on the XWiki installation when the page is included.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 16:33 UTC. All times on this page are UTC.
Installations of XWiki that have the XWiki Remote Macros extension between 1.13 and 1.14.5, typically wikis that migrated content from Confluence. Any user who can edit a page can exploit it, so the risk is highest on wikis with open or broad edit rights; wikis without this extension, or already on 1.14.5 or later, are not affected.
No product ranges from the sources yet.
xwiki-pro-macros-ui) in the extension manager or the Administration page of the wiki.Confluence.Macros.ExcerptInclude page in the wiki and confirm whether the excerpt-include macro is in use.1.14.5 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence. From 1.13 until 1.14.5, the excerpt-include macro does not properly escape the included page's title and executes excerpt content with the macro's rights. The title handling in xwiki-pro-macros-ui/src/main/resources/Confluence/Macros/ExcerptInclude.xml and the rendering of excerpt content into XWiki syntax both allow syntax injection. Any user able to edit a page, even without script or programming rights, can supply executable macro syntax in the title or excerpt and cause remote code execution when the page is included. This affects confidentiality, integrity and availability of the whole XWiki installation. This issue is fixed in version 1.14.5.
This page as .md · .json · in your agent: get_signal("CVE-2026-44179")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.