Skip to content
CVE PROGRAM SOURCE RECORD6.8 Medium

CVE-2025-65089

XWiki view file macro: User can view content of office file without view rights on the attachment

Description

XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence. Prior to version 1.27.0, a user with no view rights on a page may see the content of an office attachment displayed with the view file macro. This issue has been patched in version 1.27.0.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

xwikisas xwiki-pro-macros

  • < 1.27.0affected

References