What’s Vulnerable › Vulnerabilities
CVE-2026-44179: XWiki Pro Macros: excerpt-include title and content injection executes code
- Severity: critical (CVSS 9.9 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.7% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-10-28 · updated 2026-10-29
- Weakness: CWE-95
Description
XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence. From 1.13 until 1.14.5, the `excerpt-include` macro does not properly escape the included page's title and executes `excerpt` content with the macro's rights. The title handling in `xwiki-pro-macros-ui/src/main/resources/Confluence/Macros/ExcerptInclude.xml` and the rendering of `excerpt` content into XWiki syntax both allow syntax injection. Any user able to edit a page, even without script or programming rights, can supply executable macro syntax in the title or `excerpt` and cause remote code execution when the page is included. This affects confidentiality, integrity and availability of the whole XWiki installation. This issue is fixed in version 1.14.5.
Summary
CVE-2026-44179 is a critical syntax injection flaw in XWiki Pro Macros: the `excerpt-include` macro fails to escape the included page's title and renders `excerpt` content with the macro's rights, allowing executable macro syntax to run. Any user who can edit a page, even without script or programming rights, can trigger remote code execution when the page is included, compromising the confidentiality, integrity and availability of the whole XWiki installation. Affected versions are 1.13 through 1.14.4; the issue is fixed in 1.14.5. It is not listed in CISA KEV, so no known active exploitation is reported; upgrade to 1.14.5 or later, and until then restrict page-edit rights and review pages using `excerpt-include`.
تُعدّ CVE-2026-44179 ثغرة حقن صياغي حرجة في XWiki Pro Macros، إذ لا يقوم ماكرو `excerpt-include` بتهريب عنوان الصفحة المُضمَّنة بشكل صحيح، ويعالج محتوى `excerpt` بصلاحيات الماكرو، ما يسمح بتنفيذ صياغة ماكرو قابلة للتشغيل. يستطيع أي مستخدم قادر على تعديل صفحة، حتى دون صلاحيات scripting أو programming، حقن صياغة قابلة للتنفيذ في العنوان أو في `excerpt` والتسبب في تنفيذ تعليمات برمجية عن بُعد عند تضمين الصفحة، مما يؤثر على السرية والسلامة والتوافر لكامل تركيب XWiki. تشمل الإصدارات المتأثرة 1.13 حتى 1.14.4، وتم إصلاح المشكلة في الإصدار 1.14.5. الثغرة غير مدرجة في CISA KEV ولا توجد تقارير عن استغلال نشط؛ يُنصح بالترقية إلى 1.14.5 أو أحدث، وإلى حين ذلك تقييد صلاحيات تعديل الصفحات ومراجعة الصفحات التي تستخدم `excerpt-include`.
Affected products
- xwikisas xwiki-pro-macros: from 1.13, < 1.14.5
References
- https://github.com/xwikisas/xwiki-pro-macros/commit/151d4fccb62f6ec5f3c972e837869454677ab1ca
- https://github.com/xwikisas/xwiki-pro-macros/releases/tag/xwiki-pro-macros-1.14.5
- https://github.com/xwikisas/xwiki-pro-macros/security/advisories/GHSA-w56x-9778-rppx
Get alerted when CVE-2026-44179 or the next vulnerability affects your stack