XWiki Remote Macs: Users Without View Rights Leaking Attachments 1.26
CVE-2025-65089 Published on November 19, 2025
XWiki view file macro: User can view content of office file without view rights on the attachment
XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence. Prior to version 1.27.0, a user with no view rights on a page may see the content of an office attachment displayed with the view file macro. This issue has been patched in version 1.27.0.
Vulnerability Analysis
CVE-2025-65089 can be exploited with network access, requires user interaction and a small amount of user privileges. This vulnerability is considered to have a low attack complexity. Public availability of a proof of concept (POC) exploit exists for CVE-2025-65089. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality, with no impact on integrity and availability.
Weakness Type
What is an AuthZ Vulnerability?
The software does not perform an authorization check when an actor attempts to access a resource or perform an action.
CVE-2025-65089 has been classified to as an AuthZ vulnerability or weakness.
Products Associated with CVE-2025-65089
Want to know whenever a new CVE is published for Xwiki? stack.watch will email you.
Affected Versions
xwikisas xwiki-pro-macros Version < 1.27.0 is affected by CVE-2025-65089Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.