6.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-65089

CVE-2025-65089: XWiki view file macro: User can view content of office file without view rights on the attachment

XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence. Prior to version 1.27.0, a user with no view rights on a page may see the content of an office attachment displayed with the view file macro. This issue has been patched in version 1.27.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-65089

CVE-2025-65089:

6.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
com.xwiki.pro:xwiki-pro-macros-ui	maven	<= 1.26.20	1.27.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, GHSA-8c52-x9w7-vc95, is a missing authorization flaw in the 'view file' macro of XWiki Pro Macros. It allows a user to view the content of an office file attachment from a restricted page if it's embedded on a public page, even if the user lacks view rights for the restricted content.

The analysis of the patch that fixes this vulnerability reveals that the issue was not in a compiled Java class but in a Velocity template file: xwiki-pro-macros-api/src/main/resources/templates/viewfile/viewFileTemplate.vm. This template contains the rendering logic for the macro.

The patch, found in commit 481f5a8bc6622bb40b7843f85050f23867342917, introduces a crucial security check. It now uses the $xwiki.checkAccess() function to verify if the user has 'view' rights on the attachment before proceeding to render its content. Previously, the template would directly call the #continueExecutingMacro to display the file, completely bypassing any permission checks.

The vulnerable function is therefore the rendering process of the viewFileTemplate.vm itself. During exploitation, a profiler would show the execution of this template as it processes the malicious macro, leading to the unauthorized disclosure of the attachment's content.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.