CVE-2025-27603: XWiki Confluence Migrator Pro allows Remote Code Execution via unescaped translations

Severity: critical (CVSS 9.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-03-07 · updated 2026-06-17
Weakness: CWE-95

Description

XWiki Confluence Migrator Pro helps admins to import confluence packages into their XWiki instance. A user that doesn't have programming rights can execute arbitrary code due to an unescaped translation when creating a page using the Migration Page template. This vulnerability is fixed in 1.2.0.

Affected products

xwikisas application-confluence-migrator-pro: > 1.0, < 1.2.0

References

https://github.com/xwikisas/application-confluence-migrator-pro/commit/36cef2271bd429773698ca3a21e47b6d51d6377d
https://github.com/xwikisas/application-confluence-migrator-pro/security/advisories/GHSA-6qvp-39mm-95v8
https://github.com/xwikisas/application-confluence-migrator-pro/security/advisories/GHSA-6qvp-39mm-95v8

Get alerted when CVE-2025-27603 or the next vulnerability affects your stack