CVE-2025-55727 is a critical severity (10.0) remote code execution flaw in XWiki Remote Macros, caused by missing escaping of the width parameter in the column macro. It affects versions from 1.0 and is fixed in 1.26.5. Upgrade the extension to 1.26.5 or later.
What's affected
XWiki Remote Macros provides rendering macros that are useful when migrating content from Confluence. The Maven package is com.xwiki.pro:xwiki-pro-macros. The advisory (GHSA-hxqp-983c-m8h9) lists all versions from 1.0 up to but not including 1.26.5 as affected, and 1.26.5 as the patched version.
The width parameter of the column macro is used without escaping. That lets someone inject XWiki syntax, which can lead to code execution. The advisory says any user who can edit a page or who can access the CKEditor converter can reach it. The advisory lists no workaround and describes upgrading as the remedy.
The CVSS 3.1 score is 10.0, the maximum, with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. The CVE is not on the CISA KEV list.
How to check if you're exposed
- In XWiki, open Administration, then Extension Manager, and look for "XWiki Remote Macros" (also called XWiki Pro Macros) in the installed extensions. Read its version.
- If you manage XWiki through Maven or a custom build, search the dependency tree:
mvn dependency:tree | grep xwiki-pro-macros. - Anything below 1.26.5 is affected according to the advisory.
- Check who holds edit rights on your wiki, and whether anonymous or broad groups can edit pages.
- Check whether the CKEditor converter is reachable by users who should not have access.
Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan. It is built for package manifests, so it will not see a standalone server or a PHP project you downloaded as a zip. For those, an asset inventory of what you run is the starting point.
What to do now
- Upgrade the Remote Macros extension to 1.26.5 or later from the Extension Manager, and test your migrated Confluence pages afterwards.
- Reduce page edit rights to the people who need them until the upgrade is done.
- Review recent page edits, especially to pages that use the column macro, for content you do not recognise.
- Review XWiki admin accounts and scripting rights for changes you cannot explain.
- Rotate secrets stored in the wiki or on the host if you find signs of misuse.
- Add the extension to your inventory so the next release note reaches someone.
Why it matters
The classes are CWE-94 and CWE-95: injection of code into something that is evaluated. When a macro parameter is placed into the page's own markup without escaping, the value can become syntax that the wiki runs. XWiki can run Velocity and other scripts, so the result can reach the whole installation, which is why the advisory scores it at 10.0.
A wiki is a shared space, and many people can edit pages, so a bug that needs only edit rights is wide in practice. Two sibling CVEs cover other macros in the same extension, and the fix for all of them is the same release.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which version fixes it?
Version 1.26.5 of xwiki-pro-macros, according to the GitHub advisory GHSA-hxqp-983c-m8h9.
Is there a workaround?
The advisory lists none. Upgrading is the described remedy, and limiting page edit rights reduces exposure until then.
Sources
- https://github.com/xwikisas/xwiki-pro-macros/blob/aed17fa3db4081846dbb6bdf76ba10cf44401c44/xwiki-pro-macros-ui/src/main/resources/Confluence/Macros/Column.xml#L438 (listed in the CVE record)
- https://github.com/xwikisas/xwiki-pro-macros/commit/05651adb4b58d03ba862d5290c645feeffd2121b (listed in the CVE record)
- https://github.com/xwikisas/xwiki-pro-macros/security/advisories/GHSA-hxqp-983c-m8h9 (fetched for this post)
- Safeguard Gold entry for CVE-2025-55727
Last reviewed: 18 October 2026.
