{"id":"CVE-2026-44179","kind":"vulnerability","aliases":["CVE-2026-44179"],"related":[],"title":"XWiki Remote Macros: page editors can run code via excerpt-include","description":"XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence. From 1.13 until 1.14.5, the `excerpt-include` macro does not properly escape the included page's title and executes `excerpt` content with the macro's rights. The title handling in `xwiki-pro-macros-ui/src/main/resources/Confluence/Macros/ExcerptInclude.xml` and the rendering of `excerpt` content into XWiki syntax both allow syntax injection. Any user able to edit a page, even without script or programming rights, can supply executable macro syntax in the title or `excerpt` and cause remote code execution when the page is included. This affects confidentiality, integrity and availability of the whole XWiki installation. This issue is fixed in version 1.14.5.","summary":"XWiki Remote Macros from 1.13 up to 1.14.5 mishandles the title and excerpt content of the excerpt-include macro, letting any user who can edit a page inject macro syntax. The injected macro runs with the rights of the macro, so an attacker who only has edit rights can execute code on the XWiki installation when the page is included.","severity":"critical","cvss":9.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["confluence-migration","package","self-hosted","xwiki"],"not_affected_if":["extension-not-installed","version-1.14.5-or-later"],"how_to_check":"- Check the installed version of the XWiki Remote Macros extension (`xwiki-pro-macros-ui`) in the extension manager or the `Administration` page of the wiki.\n- Look for the `Confluence.Macros.ExcerptInclude` page in the wiki and confirm whether the `excerpt-include` macro is in use.","fix":"- Upgrade XWiki Remote Macros to `1.14.5` or later.\n- Until the upgrade, restrict page edit rights on wikis that have the extension installed.","status":"open","published_at":"2026-10-28T16:17:07+00:00","first_seen_at":"2026-10-28T16:33:49+00:00","triaged_at":"2026-10-28T16:35:45+00:00","updated_at":"2026-10-28T16:35:45+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-28T16:35:45Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade XWiki Remote Macros to `1.14.5` or later.\n- Until the upgrade, restrict page edit rights on wikis that have the extension installed.","reach":"network","title":"XWiki Remote Macros: page editors can run code via excerpt-include","impact":"high","summary":"XWiki Remote Macros from 1.13 up to 1.14.5 mishandles the title and excerpt content of the excerpt-include macro, letting any user who can edit a page inject macro syntax. The injected macro runs with the rights of the macro, so an attacker who only has edit rights can execute code on the XWiki installation when the page is included.","category":"package","nicknames":[],"who_cares":["xwiki","self-hosted","confluence-migration"],"confidence":0.8,"needs_auth":"yes","worst_case":"Code runs on the XWiki server with macro rights, exposing all wiki data.","analyst_note":"Confirm the exact scope of the excerpt-include macro and whether the issue needs the macro to be used on a page; check the NVD and XWiki advisory for a workaround.","how_to_check":"- Check the installed version of the XWiki Remote Macros extension (`xwiki-pro-macros-ui`) in the extension manager or the `Administration` page of the wiki.\n- Look for the `Confluence.Macros.ExcerptInclude` page in the wiki and confirm whether the `excerpt-include` macro is in use.","needs_analyst":true,"not_affected_if":["extension-not-installed","version-1.14.5-or-later"],"who_is_affected":"Installations of XWiki that have the XWiki Remote Macros extension between 1.13 and 1.14.5, typically wikis that migrated content from Confluence. Any user who can edit a page can exploit it, so the risk is highest on wikis with open or broad edit rights; wikis without this extension, or already on 1.14.5 or later, are not affected.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000696,"input_tokens":3478,"output_tokens":696,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-44179':15A,18A '/src/main/resources/confluence/macros/excerptinclude.xml':139C '1.13':31B,104C '1.14.5':34B,106C,203C 'abl':155C 'affect':187C 'allow':150C 'attack':70B 'avail':191C 'caus':177C 'code':8A,78B,179C 'confidenti':188C 'confluenc':20B,102C 'confluence-migr':19B 'content':40B,100C,124C,145C 'cve':13A,16A 'edit':52B,74B,157C 'editor':5A 'escap':115C 'even':160C 'excerpt':11A,39B,44B,109C,123C,144C,175C 'excerpt-includ':10A,43B,108C 'execut':77B,122C,168C,180C 'fix':200C 'handl':132C 'host':25B 'includ':12A,45B,87B,110C,117C,185C 'inject':55B,59B,152C 'instal':82B,196C 'integr':189C 'issu':198C 'let':47B 'macro':3A,29B,46B,56B,60B,67B,90C,94C,111C,127C,137C,169C 'migrat':21B,99C 'mishandl':35B 'packag':22B 'page':4A,54B,85B,118C,159C,183C 'pro':136C 'program':164C 'proper':114C 'provid':91C 'remot':2A,28B,89C,178C 'render':93C,142C 'right':64B,75B,129C,165C 'run':7A,61B 'script':162C 'self':24B 'self-host':23B 'suppli':167C 'syntax':57B,148C,151C,170C 'titl':37B,120C,131C,173C 'ui':138C 'use':97C 'user':49B,154C 'version':202C 'via':9A 'whole':194C 'without':161C 'xwiki':1A,26B,27B,81B,88C,92C,135C,147C,195C 'xwiki-pro-macros-ui':134C","nicknames":[],"mitigations":[],"who_affected":"Installations of XWiki that have the XWiki Remote Macros extension between 1.13 and 1.14.5, typically wikis that migrated content from Confluence. Any user who can edit a page can exploit it, so the risk is highest on wikis with open or broad edit rights; wikis without this extension, or already on 1.14.5 or later, are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T16:17:07+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-44179","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44179","severity":null,"published_at":"2026-10-28T16:17:07+00:00","modified_at":"2026-10-28T16:17:07+00:00","first_seen_at":"2026-10-28T16:33:49+00:00","fetched_at":"2026-10-28T16:33:49+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}