---
id: "CVE-2026-44179"
kind: "vulnerability"
aliases: ["CVE-2026-44179"]
title: "XWiki Remote Macros: page editors can run code via excerpt-include"
severity: "critical"
cvss: 9.9
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["confluence-migration", "package", "self-hosted", "xwiki"]
not_affected_if: ["extension-not-installed", "version-1.14.5-or-later"]
published_at: "2026-10-28T16:17:07+00:00"
first_seen_at: "2026-10-28T16:33:49+00:00"
updated_at: "2026-10-28T16:35:45+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44179", "first_seen_at": "2026-10-28T16:33:49+00:00"}]
---

# XWiki Remote Macros: page editors can run code via excerpt-include

XWiki Remote Macros from 1.13 up to 1.14.5 mishandles the title and excerpt content of the excerpt-include macro, letting any user who can edit a page inject macro syntax. The injected macro runs with the rights of the macro, so an attacker who only has edit rights can execute code on the XWiki installation when the page is included.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of the XWiki Remote Macros extension (`xwiki-pro-macros-ui`) in the extension manager or the `Administration` page of the wiki.
- Look for the `Confluence.Macros.ExcerptInclude` page in the wiki and confirm whether the `excerpt-include` macro is in use.

## Fix

- Upgrade XWiki Remote Macros to `1.14.5` or later.
- Until the upgrade, restrict page edit rights on wikis that have the extension installed.

## Timeline

- 2026-10-28T16:33:49+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-44179

## From the sources

XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence. From 1.13 until 1.14.5, the `excerpt-include` macro does not properly escape the included page's title and executes `excerpt` content with the macro's rights. The title handling in `xwiki-pro-macros-ui/src/main/resources/Confluence/Macros/ExcerptInclude.xml` and the rendering of `excerpt` content into XWiki syntax both allow syntax injection. Any user able to edit a page, even without script or programming rights, can supply executable macro syntax in the title or `excerpt` and cause remote code execution when the page is included. This affects confidentiality, integrity and availability of the whole XWiki installation. This issue is fixed in version 1.14.5.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_