CVE-2025-55728 is a critical severity (10.0) remote code execution flaw in XWiki Remote Macros, caused by missing escaping of the classes parameter in the panel macro. It affects versions from 1.0 and is fixed in 1.26.5. Upgrade the extension to 1.26.5 or later.
What's affected
XWiki Remote Macros provides rendering macros that are useful when migrating content from Confluence. The Maven package is com.xwiki.pro:xwiki-pro-macros. The advisory (GHSA-48f4-h726-74p5) lists all versions from 1.0 up to but not including 1.26.5 as affected, and 1.26.5 as the patched version.
The classes parameter of the panel macro is used without escaping. That lets someone inject XWiki syntax, which can lead to code execution. The advisory says any user who can edit a page can reach it. It also suggests that view rights may be enough, citing a related XWiki issue, XWIKI-20449. The advisory lists no workaround and describes upgrading as the remedy.
The CVSS 3.1 score is 10.0, the maximum, with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. The CVE is not on the CISA KEV list.
How to check if you're exposed
- In XWiki, open Administration, then Extension Manager, and look for "XWiki Remote Macros" (also called XWiki Pro Macros) in the installed extensions. Read its version.
- If you manage XWiki through Maven or a custom build, search the dependency tree:
mvn dependency:tree | grep xwiki-pro-macros. - Anything below 1.26.5 is affected according to the advisory.
- Check who holds edit rights on your wiki, and whether anonymous or broad groups can edit pages.
- Check whether the CKEditor converter is reachable by users who should not have access.
Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan. It is built for package manifests, so it will not see a standalone server or a PHP project you downloaded as a zip. For those, an asset inventory of what you run is the starting point.
What to do now
- Upgrade the Remote Macros extension to 1.26.5 or later from the Extension Manager, and test your migrated Confluence pages afterwards.
- Reduce page edit rights to the people who need them until the upgrade is done.
- Review recent page edits, especially to pages that use the panel macro, for content you do not recognise.
- Review XWiki admin accounts and scripting rights for changes you cannot explain.
- Rotate secrets stored in the wiki or on the host if you find signs of misuse.
- Add the extension to your inventory so the next release note reaches someone.
Why it matters
The classes are CWE-94 and CWE-95: injection of code into something that is evaluated. When a macro parameter is placed into the page's own markup without escaping, the value can become syntax that the wiki runs. XWiki can run Velocity and other scripts, so the result can reach the whole installation, which is why the advisory scores it at 10.0.
A wiki is a shared space, and many people can edit pages, so a bug that needs only edit rights is wide in practice. Two sibling CVEs cover other macros in the same extension, and the fix for all of them is the same release.
Quick check
Which version fixes it?
Version 1.26.5 of xwiki-pro-macros, according to the GitHub advisory GHSA-48f4-h726-74p5.
Is there a workaround?
The advisory lists none. Upgrading is the described remedy, and limiting page edit rights reduces exposure until then.
Sources
- https://github.com/xwikisas/xwiki-pro-macros/blob/93ac1a38c829e3ef787379b2b45eb043a573e5f7/xwiki-pro-macros-ui/src/main/resources/XWiki/Macros/Panel.xml#L554 (listed in the CVE record)
- https://github.com/xwikisas/xwiki-pro-macros/commit/3ca815294bf54fc024b2363efbece7aa08b8efd5 (listed in the CVE record)
- https://github.com/xwikisas/xwiki-pro-macros/security/advisories/GHSA-48f4-h726-74p5 (fetched for this post)
- https://jira.xwiki.org/browse/XWIKI-20449 (listed in the CVE record)
- Safeguard Gold entry for CVE-2025-55728
Last reviewed: 18 October 2026.
