Listen to this Post
How the CVE Works
The vulnerability in XWiki Rendering arises due to improper handling of nested macros in restricted mode. The default macro content parser fails to preserve the `restricted` attribute of the transformation context when processing nested macros. This oversight allows attackers to bypass security restrictions and execute forbidden macros, such as script macros, even in restricted environments. The flaw is exploitable via crafted XWiki syntax within comments, enabling privilege escalation from basic comment rights to full programming rights, leading to remote code execution. The issue has existed since XWiki 4.2, where the restricted attribute was introduced.
DailyCVE Form:
Platform: XWiki Rendering
Version: 4.2-milestone-1 to 13.10.10, 14.0-14.4.6, 14.5-14.9
Vulnerability: RCE via macros
Severity: Critical
Date: Jul 15, 2025
Prediction: Patch expected by Jul 20, 2025
What Undercode Say
Check XWiki version xwiki-version --status Verify macro restrictions grep -r "restricted" /etc/xwiki/ Disable comments (workaround) xwiki-config --disable-comments
How Exploit
1. Inject nested macros in comments. 2. Bypass restricted mode via script macros. 3. Execute arbitrary code.
Protection from this CVE
Upgrade to 13.10.11/14.4.7/14.10. Disable comments for untrusted users.
Impact
Privilege escalation to RCE. Compromise of XWiki instances.
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
