{"id":"CVE-2026-44179","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-44179","generatedAt":"2026-11-04T11:42:44.430Z","title":"XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence.","description":"XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence. From 1.13 until 1.14.5, the `excerpt-include` macro does not properly escape the included page's title and executes `excerpt` content with the macro's rights. The title handling in `xwiki-pro-macros-ui/src/main/resources/Confluence/Macros/ExcerptInclude.xml` and the rendering of `excerpt` content into XWiki syntax both allow syntax injection. Any user able to edit a page, even without script or programming rights, can supply executable macro syntax in the title or `excerpt` and cause remote code execution when the page is included. This affects confidentiality, integrity and availability of the whole XWiki installation. This issue is fixed in version 1.14.5.","published":"2026-10-28T16:17:07.000Z","lastModified":"2026-11-02T21:17:31.000Z","status":"Deferred","sourceIdentifier":"security-advisories@github.com","cvss":{"version":"3.1","score":9.9,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"},"cwe":["CWE-95"],"affected":[],"epss":{"score":0.0069,"percentile":0.52855,"date":"2026-11-03","history":[{"date":"2026-10-29","score":0.0069,"percentile":0.52723}]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"high","text":"High impact if exploited, but EPSS currently rates exploitation as unlikely (0.69%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit."},"changes":[{"kind":"new","label":"New CVE","at":"2026-10-28T16:17:07.000Z","detail":{"score":"9.9","severity":"CRITICAL","publishedAt":"2026-10-28T16:17:07.400Z"},"summary":"New CVE, critical severity (CVSS 9.9)."}],"references":[{"url":"https://github.com/xwikisas/xwiki-pro-macros/commit/151d4fccb62f6ec5f3c972e837869454677ab1ca","source":"security-advisories@github.com"},{"url":"https://github.com/xwikisas/xwiki-pro-macros/releases/tag/xwiki-pro-macros-1.14.5","source":"security-advisories@github.com"},{"url":"https://github.com/xwikisas/xwiki-pro-macros/security/advisories/GHSA-w56x-9778-rppx","source":"security-advisories@github.com"},{"url":"https://github.com/xwikisas/xwiki-pro-macros/security/advisories/GHSA-w56x-9778-rppx","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-44179","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}