CVE-2025-27604: XWiki Confluence Migrator Pro's homepage is public

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-03-07 · updated 2026-06-17
Weakness: CWE-200

Description

XWiki Confluence Migrator Pro helps admins to import confluence packages into their XWiki instance. The homepage of the application is public which enables a guest to download the package which might contain sensitive information. This vulnerability is fixed in 1.11.7.

Affected products

xwikisas application-confluence-migrator-pro: before 1.11.7 — fixed in 1.11.7

How to fix

Upgrade to a fixed version: xwikisas application-confluence-migrator-pro 1.11.7. Check the vendor advisory for mitigations.

References

https://github.com/xwikisas/application-confluence-migrator-pro/commit/6ced42b1f341fd0ce6734fc58c7d694da5f365fb
https://github.com/xwikisas/application-confluence-migrator-pro/security/advisories/GHSA-3w9f-2pph-j5vc

Get alerted when CVE-2025-27604 or the next vulnerability affects your stack