CVE-2025-65036

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-65036
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-65036.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2025-65036
Aliases
  • GHSA-472x-fwh9-r82f
Published
2025-12-05T16:10:08.595Z
Modified
2026-03-12T04:30:53.339975Z
Severity
  • 8.3 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L CVSS Calculator
Summary
XWiki Remote Macros vulnerable to remote code execution using the confluence details summary macro
Details

XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence. Prior to 1.27.1, the macro executes Velocity from the details pages without checking for permissions, which can lead to remote code execution. This vulnerability is fixed in 1.27.1.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/65xxx/CVE-2025-65036.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-862"
    ]
}
References

Affected packages

Git / github.com/xwikisas/xwiki-pro-macros

Affected ranges

Type
GIT
Repo
https://github.com/xwikisas/xwiki-pro-macros
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
383df3ee02ed1ea8e90168db537cbc0f0bbb1f64

Affected versions

xwiki-pro-macros-1.*
xwiki-pro-macros-1.0
xwiki-pro-macros-1.0-RC1
xwiki-pro-macros-1.1
xwiki-pro-macros-1.1.1
xwiki-pro-macros-1.10
xwiki-pro-macros-1.10.1
xwiki-pro-macros-1.12
xwiki-pro-macros-1.13
xwiki-pro-macros-1.14.5
xwiki-pro-macros-1.2
xwiki-pro-macros-1.2.1
xwiki-pro-macros-1.2.2
xwiki-pro-macros-1.6
xwiki-pro-macros-1.6.1
xwiki-pro-macros-1.7
xwiki-pro-macros-1.7.1
xwiki-pro-macros-1.8
xwiki-pro-macros-1.8.1
xwiki-pro-macros-1.9.3
xwiki-pro-macros-parent-1.*
xwiki-pro-macros-parent-1.11.0
xwiki-pro-macros-parent-1.14.0
xwiki-pro-macros-parent-1.14.1
xwiki-pro-macros-parent-1.14.2
xwiki-pro-macros-parent-1.14.3
xwiki-pro-macros-parent-1.14.4
xwiki-pro-macros-parent-1.15.0
xwiki-pro-macros-parent-1.15.1
xwiki-pro-macros-parent-1.16.0
xwiki-pro-macros-parent-1.16.1
xwiki-pro-macros-parent-1.16.2
xwiki-pro-macros-parent-1.16.3
xwiki-pro-macros-parent-1.16.4
xwiki-pro-macros-parent-1.16.5
xwiki-pro-macros-parent-1.16.6
xwiki-pro-macros-parent-1.17.0
xwiki-pro-macros-parent-1.17.1
xwiki-pro-macros-parent-1.17.2
xwiki-pro-macros-parent-1.17.3
xwiki-pro-macros-parent-1.18.0
xwiki-pro-macros-parent-1.18.1
xwiki-pro-macros-parent-1.18.2
xwiki-pro-macros-parent-1.18.3
xwiki-pro-macros-parent-1.19.0
xwiki-pro-macros-parent-1.19.1
xwiki-pro-macros-parent-1.19.2
xwiki-pro-macros-parent-1.19.3
xwiki-pro-macros-parent-1.19.4
xwiki-pro-macros-parent-1.19.5
xwiki-pro-macros-parent-1.19.6
xwiki-pro-macros-parent-1.19.7
xwiki-pro-macros-parent-1.19.8
xwiki-pro-macros-parent-1.19.9
xwiki-pro-macros-parent-1.20.0
xwiki-pro-macros-parent-1.21.0
xwiki-pro-macros-parent-1.22.0
xwiki-pro-macros-parent-1.22.1
xwiki-pro-macros-parent-1.22.2
xwiki-pro-macros-parent-1.22.3
xwiki-pro-macros-parent-1.23.0
xwiki-pro-macros-parent-1.23.1
xwiki-pro-macros-parent-1.23.2
xwiki-pro-macros-parent-1.24.0
xwiki-pro-macros-parent-1.25.0
xwiki-pro-macros-parent-1.25.1
xwiki-pro-macros-parent-1.25.2
xwiki-pro-macros-parent-1.25.3
xwiki-pro-macros-parent-1.25.4
xwiki-pro-macros-parent-1.25.5
xwiki-pro-macros-parent-1.26.0
xwiki-pro-macros-parent-1.26.1
xwiki-pro-macros-parent-1.26.10
xwiki-pro-macros-parent-1.26.11
xwiki-pro-macros-parent-1.26.12
xwiki-pro-macros-parent-1.26.13
xwiki-pro-macros-parent-1.26.14
xwiki-pro-macros-parent-1.26.15
xwiki-pro-macros-parent-1.26.16
xwiki-pro-macros-parent-1.26.17
xwiki-pro-macros-parent-1.26.18
xwiki-pro-macros-parent-1.26.19
xwiki-pro-macros-parent-1.26.2
xwiki-pro-macros-parent-1.26.20
xwiki-pro-macros-parent-1.26.3
xwiki-pro-macros-parent-1.26.4
xwiki-pro-macros-parent-1.26.5
xwiki-pro-macros-parent-1.26.6
xwiki-pro-macros-parent-1.26.7
xwiki-pro-macros-parent-1.26.8
xwiki-pro-macros-parent-1.26.9
xwiki-pro-macros-parent-1.27.0
xwiki-pro-macros-parent-1.27.0-rc-1
xwiki-pro-macros-parent-1.3
xwiki-pro-macros-parent-1.4
xwiki-pro-macros-parent-1.5
xwiki-pro-macros-parent-1.9
xwiki-pro-macros-parent-1.9.1
xwiki-pro-macros-parent-1.9.2

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-65036.json"