CVE-2025-55729: XWiki Remote Macros RCE Vulnerability

CVE-2025-55729 Overview

CVE-2025-55729 is a critical remote code execution vulnerability affecting XWiki Remote Macros, a component that provides XWiki rendering macros useful for migrating content from Confluence. The vulnerability exists in the ConfluenceLayoutSection macro where the ac:type parameter is used without proper escaping, allowing attackers to inject arbitrary XWiki syntax and achieve remote code execution.

Any user with page editing privileges can exploit this vulnerability to execute arbitrary code on the server, potentially leading to complete system compromise. The flaw stems from improper output encoding (CWE-116) where user-controlled input flows directly into XWiki syntax without sanitization.

Critical Impact

This vulnerability enables unauthenticated remote code execution through XWiki syntax injection, allowing attackers to fully compromise affected XWiki installations with no user interaction required.

Affected Products

• XWiki Remote Macros version 1.0 through versions prior to 1.26.5
• XWiki Pro Macros Confluence Bridges component
• XWiki installations using the ConfluenceLayoutSection macro

Discovery Timeline

• 2025-09-09 - CVE-2025-55729 published to NVD
• 2025-09-11 - Last updated in NVD database

Technical Details for CVE-2025-55729

Vulnerability Analysis

This vulnerability represents a classic case of improper output encoding leading to code injection. The ConfluenceLayoutSection macro, designed to help migrate content from Confluence to XWiki, accepts a parameter called ac:type that specifies the CSS layout class for section rendering. This parameter is directly interpolated into XWiki's Velocity template syntax without any escaping or sanitization.

XWiki uses a wiki-based syntax that supports macro execution and scripting capabilities. When user-controlled input is embedded directly into this syntax without proper encoding, an attacker can break out of the intended context and inject arbitrary XWiki macros, including those that execute server-side code.

The vulnerability requires only page editing privileges to exploit, making it particularly dangerous in multi-user XWiki environments where untrusted users may have content editing capabilities.

Root Cause

The root cause is the direct use of the ac:type parameter value in XWiki syntax without applying the $services.rendering.escape() function. In the vulnerable code path, the cssLayoutClass variable is set directly from $xcontext.macro.params.get('ac:type') and then concatenated into a class attribute within XWiki's extended syntax notation.

XWiki's syntax interpreter processes special characters and macro invocations within the content, meaning that malicious input containing XWiki syntax elements (such as {{/velocity}} or Groovy script blocks) would be interpreted and executed rather than treated as literal text.

Attack Vector

The attack vector is network-based and requires no authentication in configurations where anonymous users can edit pages, or low-privileged access in authenticated environments. An attacker can:

1. Navigate to any editable XWiki page
2. Insert the ConfluenceLayoutSection macro with a crafted ac:type parameter
3. Include XWiki syntax injection payloads that escape the intended CSS class context
4. Execute arbitrary Groovy or Velocity code on the server

The following patch demonstrates the fix applied in version 1.26.5:

       <code>{{velocity output="false"}}
 #macro (executeMacro)
   #set ($discard = $xwiki.ssx.use('Confluence.Macros.ConfluenceLayoutSection'))
-  #set ($cssLayoutClass = $xcontext.macro.params.get('ac:type'))
+  #set ($cssLayoutClass = $services.rendering.escape("$!xcontext.macro.params.get('ac:type')", 'xwiki/2.1'))
   (% class="macro-layout-section $cssLayoutClass" %)(((\n     ## Since 11.5 the content of the macro can be edited in WYSIWYG editor.
     #if ($services.rendering.getMacroDescriptor($services.rendering.resolveMacroId('wikimacrocontent')))

Source: GitHub Commit Changes

The fix wraps the parameter value with $services.rendering.escape(), ensuring that any XWiki syntax characters are properly escaped before being rendered.

Detection Methods for CVE-2025-55729

Indicators of Compromise

• Unusual page edits containing ConfluenceLayoutSection macro with suspicious ac:type values
• XWiki log entries showing execution of unexpected Groovy or Velocity scripts
• Pages containing escape sequences like }}, {{groovy}}, or {{velocity}} in macro parameters
• Unexpected process spawning or network connections originating from the XWiki application server

Detection Strategies

• Monitor XWiki audit logs for page modifications involving the ConfluenceLayoutSection macro
• Implement content scanning rules to detect XWiki syntax patterns within macro parameters
• Deploy web application firewall (WAF) rules to identify and block requests containing wiki syntax injection attempts
• Review recent page edit history for anomalous patterns or edits from unfamiliar accounts

Monitoring Recommendations

• Enable detailed audit logging for all page edit operations in XWiki
• Configure alerting on execution of Groovy or Velocity scripts outside of trusted macro contexts
• Monitor system processes and network connections originating from the XWiki Java process
• Implement file integrity monitoring on the XWiki installation directory

How to Mitigate CVE-2025-55729

Immediate Actions Required

• Upgrade XWiki Remote Macros to version 1.26.5 or later immediately
• Review XWiki audit logs for evidence of exploitation attempts
• Temporarily disable the ConfluenceLayoutSection macro if immediate patching is not possible
• Restrict page editing privileges to trusted users until the patch is applied

Patch Information

The vulnerability has been fixed in XWiki Remote Macros version 1.26.5. The patch applies proper output encoding using $services.rendering.escape() to the ac:type parameter before it is used in XWiki syntax. Organizations should upgrade to this version or later to remediate the vulnerability.

For additional details, refer to:

• GitHub Security Advisory GHSA-22xj-jpjg-gpgw
• XWiki Issue Tracker XWIKI-20449

Workarounds

• Disable or remove the ConfluenceLayoutSection macro from XWiki if not actively needed
• Implement strict access controls limiting page editing to trusted administrators only
• Deploy a web application firewall with rules to detect and block XWiki syntax injection patterns
• Consider isolating the XWiki instance in a restricted network segment until patching is complete

# Verify current xwiki-pro-macros version
grep -r "xwiki-pro-macros" /path/to/xwiki/WEB-INF/lib/*.jar

# Check XWiki logs for potential exploitation attempts
grep -i "ConfluenceLayoutSection" /path/to/xwiki/logs/*.log | grep -E "(groovy|velocity|\}\})"