CVE-2025-31487: XWiki JIRA Extension XXE Vulnerability

CVE-2025-31487 Overview

CVE-2025-31487 is an XML External Entity (XXE) vulnerability [CWE-611] in the XWiki JIRA extension. The extension provides integration points between XWiki and JIRA through macros, UI components, and a CKEditor plugin. Any authenticated XWiki user can abuse the JIRA macro to read arbitrary files from the XWiki server host. The attacker edits their own user profile page, embeds the JIRA macro, and points it to an attacker-controlled URL. That URL returns XML containing a DOCTYPE declaration that references a local file. The macro then renders the file contents inside JIRA fields such as summary or description. The vulnerability is fixed in JIRA Extension v8.6.5.

Critical Impact
Any authenticated XWiki user can exfiltrate local files from the XWiki server, including configuration files and credentials, by abusing the JIRA macro on their own profile page.

Affected Products

XWiki JIRA Extension versions prior to 8.6.5
XWiki installations with the JIRA macro installed and enabled
Self-hosted XWiki deployments integrating with JIRA via the contrib extension

Discovery Timeline

2025-04-03 - CVE-2025-31487 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-31487

Vulnerability Analysis

The XWiki JIRA extension fetches data from a configured JIRA instance over HTTP and parses the XML response. The XML parser is configured to resolve external entities and process DOCTYPE declarations supplied by the remote server. The extension treats the JIRA URL as user-controlled input through the macro parameter, so any authenticated user can substitute a malicious host. The parser then resolves entities pointing to file:// URIs on the local filesystem and embeds the resolved content in returned issue fields. The attacker reads the result by viewing the rendered page.

Root Cause

The XML parser used to deserialize JIRA responses does not disable external entity resolution or DOCTYPE processing. This is the canonical pattern for XXE flaws categorized under [CWE-611]. The macro additionally lacks a server-side allowlist of trusted JIRA endpoints, so any URL provided in the macro is fetched and parsed.

Attack Vector

Exploitation requires only a low-privileged authenticated account. The attacker hosts an HTTP service returning crafted XML similar in structure to a JIRA REST or RSS response. The XML defines an external entity such as <!ENTITY xxe SYSTEM "file:///etc/passwd"> and references it inside a field rendered by the macro. The attacker creates or edits their user profile wiki page, inserts the JIRA macro with the url parameter pointing to the malicious server, and saves the page. Rendering the page causes the XWiki server to fetch the XML, resolve the entity, and display the file contents inline. Technical details and the corrective commits are available in the GitHub Security Advisory GHSA-wc53-4255-gw3f and the patch commit.

Detection Methods for CVE-2025-31487

Indicators of Compromise

Outbound HTTP requests from the XWiki server to unexpected hosts referenced in JIRA macro url parameters.
Wiki page revisions, especially under XWiki.<username> user profile pages, containing {{jira ...}} macros pointing to non-corporate JIRA endpoints.
XWiki application logs showing XML parsing of responses with inline <!DOCTYPE> or <!ENTITY> declarations.
Sensitive file paths such as /etc/passwd, /etc/shadow, or XWiki hibernate.cfg.xml appearing in rendered wiki content.

Detection Strategies

Audit all wiki pages for occurrences of the JIRA macro and validate the url parameter against an approved list of internal JIRA hostnames.
Inspect web server and application logs for HTTP egress from the XWiki JVM process to non-allowlisted destinations.
Add network-layer monitoring for outbound traffic from the XWiki server, alerting on connections initiated immediately after page rendering events.

Monitoring Recommendations

Forward XWiki application logs and outbound proxy logs to a centralized analytics platform and correlate macro execution events with external HTTP calls.
Track modifications to user profile pages and flag additions of macros that perform server-side network requests.
Monitor for unusual read access to sensitive local files by the XWiki service account.

How to Mitigate CVE-2025-31487

Immediate Actions Required

Upgrade the XWiki JIRA extension to version 8.6.5 or later on all XWiki instances.
Review user profile pages and other wiki content for unauthorized JIRA macro usage and remove suspicious macros.
Rotate any credentials, tokens, or keys stored in files readable by the XWiki service account, assuming potential disclosure.

Patch Information

The maintainers fixed the issue in XWiki JIRA Extension v8.6.5. The corrective changes are visible in commits 5049e352 and 98a74c2a, and tracked in XWiki issue JIRA-49. The fix disables external entity and DOCTYPE processing in the XML parser used to consume JIRA responses.

Workarounds

Uninstall or disable the JIRA macro on instances where upgrading is not immediately possible.
Restrict edit rights on user profile pages so that low-privileged users cannot embed macros.
Apply egress filtering on the XWiki server to allow outbound HTTP only to approved JIRA hostnames, blocking attacker-controlled destinations.

bash

# Verify the installed XWiki JIRA extension version and upgrade via the Extension Manager
# Example using the XWiki Extension Manager CLI
xwiki-extension-manager install org.xwiki.contrib.jira:jira-macro-default/8.6.5

# Optional: block outbound HTTP from the XWiki host to anything other than the trusted JIRA endpoint
iptables -A OUTPUT -m owner --uid-owner xwiki -p tcp --dport 443 -d jira.internal.example.com -j ACCEPT
iptables -A OUTPUT -m owner --uid-owner xwiki -p tcp --dport 80 -j REJECT
iptables -A OUTPUT -m owner --uid-owner xwiki -p tcp --dport 443 -j REJECT