{"id":"CVE-2026-44179","revision":"27b9f70e9d5a4e57857b4c886567d293","records":[{"revision":"27b9f70e9d5a4e57857b4c886567d293","observedAt":"2026-10-28T16:46:48.767+00:00","statement":{"source":"cve-program","id":"CVE-2026-44179","aliases":[],"title":"XWiki Pro Macros: excerpt-include title and content injection executes code","description":"XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence. From 1.13 until 1.14.5, the `excerpt-include` macro does not properly escape the included page's title and executes `excerpt` content with the macro's rights. The title handling in `xwiki-pro-macros-ui/src/main/resources/Confluence/Macros/ExcerptInclude.xml` and the rendering of `excerpt` content into XWiki syntax both allow syntax injection. Any user able to edit a page, even without script or programming rights, can supply executable macro syntax in the title or `excerpt` and cause remote code execution when the page is included. This affects confidentiality, integrity and availability of the whole XWiki installation. This issue is fixed in version 1.14.5.","state":0,"publishedAt":"2026-10-28T15:35:45.63+00:00","modifiedAt":"2026-10-28T15:35:45.63+00:00","affected":[{"ecosystem":"Vendor product","name":"xwiki-pro-macros","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"xwikisas\",\n                    \"product\": \"xwiki-pro-macros\",\n                    \"versions\": [\n                        {\n                            \"version\": \">= 1.13, < 1.14.5\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","score":9.9,"severity":"CRITICAL"}],"references":["https://github.com/xwikisas/xwiki-pro-macros/security/advisories/GHSA-w56x-9778-rppx","https://github.com/xwikisas/xwiki-pro-macros/commit/151d4fccb62f6ec5f3c972e837869454677ab1ca","https://github.com/xwikisas/xwiki-pro-macros/releases/tag/xwiki-pro-macros-1.14.5"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-44179","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-44179","identifiers":["CVE-2026-44179"]},"retained":false,"historicalAffected":[]}],"coverage":[]}